Software Design

Understanding CORS Preflight Requests

UML Sequence Diagrams · made in Skemio

Sequence diagram showing Browser and API Server performing an HTTP OPTIONS preflight check followed by the actual POST request.
Sequence diagram showing Browser and API Server performing an HTTP OPTIONS preflight check followed by the actual POST request.
Open it in SkemioMake your own

What it shows

  • Non-simple requests (JSON, custom headers) trigger an automatic OPTIONS call.
  • The browser halts the actual request until the origin and methods are approved.
  • Access-Control-Max-Age allows browsers to cache preflight responses.

The takeaway

CORS preflight is a client-side security gate enforced by browsers, not your backend server.

More uml sequence diagrams