Which mechanism does the browser use to determine if a cross-origin request requires a preflight OPTIONS request?

Question

Web Development — Hard

Which mechanism does the browser use to determine if a cross-origin request requires a preflight OPTIONS request?

Accepted Answer

CORS preflight requests are triggered when a request is not 'simple'. A request is considered simple if it uses GET, HEAD, or POST (with specific content types like application/x-www-form-urlencoded, multipart/form-data, or text/plain) and does not include custom headers. If a request includes custom headers or a content type like application/json, the browser must send an OPTIONS request to verify permission before the actual request.