The preflight is being triggered by your Content-Type of application/json. The simplest way to prevent this is to set the Content-Type to be text/plain in your case. application/x-www-form-urlencoded & multipart/form-data Content-Types are also acceptable, but you’ll of course need to format your request payload appropriately. If you are still seeing a preflight after making this … Read more
The original standard does preclude redirect after a successful CORS preflight. Quoting § 7.1.5.3: This is the actual request. Apply the make a request steps and observe the request rules below while making the request. If the response has an HTTP status code of 301, 302, 303, 307, or 308 Apply the cache and network … Read more
I spent some time being confused as to the purpose of the preflight request but I think I’ve got it now. The key insight is that preflight requests are not a security thing. Rather, they’re a not-changing-the-rules thing. Preflight requests have nothing to do with security, and they have no bearing on applications that are … Read more
Short answer: Make the request URL in your code isn’t missing a trailing slash. A missing-trailing-slash problem is the most-common cause of the error cited in the question. But that’s not the only cause — just the most common. Read on for more details. When you see this error, it means your code is triggering … Read more
OPTIONS request are by no means an AngularJS bug, this is how Cross-Origin Resource Sharing standard mandates browsers to behave. Please refer to this document: https://developer.mozilla.org/en-US/docs/HTTP_access_control, where in the “Overview” section it says: The Cross-Origin Resource Sharing standard works by adding new HTTP headers that allow servers to describe the set of origins that are … Read more
edit 2018-09-13: added some precisions about this pre-flight request and how to avoid it at the end of this reponse. OPTIONS requests are what we call pre-flight requests in Cross-origin resource sharing (CORS). They are necessary when you’re making requests across different origins in specific situations. This pre-flight request is made by some browsers as … Read more
This answer covers a lot of ground, so it’s divided into three parts: How to use a CORS proxy to get around “No Access-Control-Allow-Origin header” problems How to avoid the CORS preflight How to fix “Access-Control-Allow-Origin header must not be the wildcard” problems How to use a CORS proxy to avoid “No Access-Control-Allow-Origin header” problems … Read more