How to apply CORS preflight cache to an entire domain

by

Preflight can only be applied to the request, not to the entire domain. I brought the same question up on the mailing list, and there were security concerns. Here’s the entire thread: http://lists.w3.org/Archives/Public/public-webapps/2012AprJun/0228.html

There are a few things to consider if you’d like to limit the number of preflight requests. First note that WebKit-based browsers set a max preflight cache lifetime of 10 minutes:

https://github.com/WebKit/webkit/blob/master/Source/WebCore/loader/CrossOriginPreflightResultCache.cpp
and Blink-based browsers limit the cache to two hours:
https://source.chromium.org/chromium/chromium/src/+/main:services/network/cors/preflight_result.cc;l=40;drc=098756533733ea50b2dcb1c40d9a9e18d49febbe

(I’m not sure if this is true for other browsers). So while you should always set the Access-Control-Max-Age header.

Next note that it is impossible to avoid a preflight on PUT/DELETE requests. So updates/deletes to your API will require at least one preflight every 10 minutes.

On GET/POST, avoid custom headers if at all possible, since these still trigger preflights. If your API returns JSON, note that a Content-Type of ‘application/json’ also triggers a preflight.

If you are willing to bend just how “RESTful” your API is, there are a few more things you can try. One is to use a Content-Type that doesn’t need a preflight, like ‘text/plain’. Custom headers always trigger preflights, so if you have any custom headers, you could move them into query parameters. At the extreme end, you could use a protocol like JSON-RPC, where all requests are made to a single endpoint.

In all honesty, because of the browser’s preflight cache limit of 10/120 minutes, and REST’s resource urls, the preflight cache is of limited value. There’s very little you can do to limit preflights over the course of a long running app. I’m hopeful the authors of the CORS spec will try to address this in the future.

More Related Contents:

  1. How to resolve ‘preflight is invalid (redirect)’ or ‘redirect is not allowed for a preflight request’
  2. Access-Control-Allow-Origin wildcard subdomains, ports and protocols
  3. What is an opaque response, and what purpose does it serve?
  4. How to enable Cross domain requests on JAX-RS web services?
  5. Adding Access-Control-Allow-Origin header response in Laravel 5.3 Passport
  6. same-origin policy and CORS – what’s the point?
  7. What is the issue CORS is trying to solve?
  8. Why are CORS requests failing in Microsoft Edge but working in other browsers?
  9. Why is Access-Control-Expose-Headers needed?
  10. Are there any browsers that set the origin header to “null” for privacy-sensitive contexts?
  11. Why does my JavaScript code receive a “No ‘Access-Control-Allow-Origin’ header is present on the requested resource” error, while Postman does not?
  12. XMLHttpRequest cannot load XXX No ‘Access-Control-Allow-Origin’ header
  13. Access-Control-Allow-Origin Multiple Origin Domains?
  14. Enabling CORS in Cloud Functions for Firebase
  15. CORS with POSTMAN
  16. How to enable CORS in ASP.net Core WebAPI
  17. canvas.toDataURL() SecurityError
  18. CORS issue while making an Ajax request for oauth2 access token
  19. No ‘Access-Control-Allow-Origin’ header in Angular 2 app
  20. Access denied in IE 10 and 11 when ajax target is localhost
  21. No ‘Access-Control-Allow-Origin’ header is present on the requested resource- AngularJS
  22. What are proper status codes for CORS preflight requests?
  23. Cross-domain connection in Socket.IO
  24. Internet Explorer 11 does not add the Origin header on a CORS request?
  25. Configure cors to allow all subdomains using ASP.NET Core (Asp.net 5, MVC6, VNext)
  26. Google’s Places API and JQuery request – Origin http://localhost is not allowed by Access-Control-Allow-Origin
  27. CORS error with jquery
  28. CORS-enabled server not denying requests
  29. Cross-Origin Resource Sharing with Spring Security
  30. CORS enabled but response for preflight has invalid HTTP status code 404 when POSTing JSON

Leave a Comment