CORS

Preflight Triggers

• Any header except: Accept, Accept-Language, Content-Language, Content-Type (with restrictions)
• Content-Type other than: application/x-www-form-urlencoded, multipart/form-data, text/plain
• Methods: PUT, DELETE, PATCH, or any custom method
• ReadableStream in request body
• Event listeners on XMLHttpRequest.upload
• One trigger = preflight; simple requests skip OPTIONS entirely

Credentials Mode

• Access-Control-Allow-Origin: * incompatible with credentials—must specify exact origin
• Access-Control-Allow-Credentials: true required for cookies/auth headers
• Fetch: credentials: 'include'; XHR: withCredentials = true
• Without credentials mode, cookies not sent even to same origin for cross-origin requests

Wildcard Limitations