CORS Preflight
Noun · Security & Infosec
Definitions
An automatic OPTIONS request sent by the browser before a cross-origin request to check whether the server allows it. Triggered by non-simple methods (PUT, DELETE), custom headers, or non-standard content types. The server responds with allowed origins, methods, and headers.
In plain English: The browser asking a server 'hey, is it OK if I send this request from a different website?' before actually sending it.
Example: "Your API is returning 405 on OPTIONS requests — add a CORS preflight handler or your frontend POST calls will all fail."
Related Terms
- CORS
- Authentication
- Content Security Policy
- HSTS
- Fetch API
- Security Headers
- Clickjacking
- DAST
- CORS Origin
- Threat Modeling
- Anti-Forensics
- Anti-Malware
- Authentication Bypass
- Bluetooth Sniffing
- Business Email Compromise
- Credential Harvesting
- Credential Replay
- Email Bombing
- ICMP Tunneling
- IDS Evasion
- Log Forging
- Log Tampering
- Multi-Factor Authentication Bypass
- OAuth Token Theft
- Ready State
- Web Crypto API
- Mitmproxy
- Blockchain Security
- HTTP Method Tampering