Try 30 days of free premium.

CORS pre-flight setting for the API over HTTPS


david wrote 6 years ago: 1

Thank you!

Since our public API only has unauthenticated GET requests, it's not necessary to send a preflight OPTIONS request. These are so-called "simple requests", as explained here: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#Simple_requests

What likely happens is that your code or library does something odd like setting a custom content type or adding a custom header, which makes the request no longer qualify as "simple request" and thus cause the browser to send the preflight.

You should track down this offending code and remove it, because that's much more efficient than supporting OPTIONS and doubling the roundtrip time.

Try 30 days of free premium.