CORS Preflight OPTIONS Request — When & Why It's Triggered
Fast recall
Quick revision
Core answer
OPTIONS sent before non-simple requests (custom headers, PUT/DELETE/PATCH, non-simple content-type); Access-Control-Max-Age caches the preflight
Adding a custom Authorization header and not allowing it in Access-Control-Allow-Headers, causing the preflight to fail silently
List what makes a request 'simple' vs preflighted per the Fetch spec, and how Access-Control-Max-Age reduces preflight traffic
Interview-ready guide
Interview answer
Open (15–20 seconds): Restate the question and give the one-sentence definition.
Body (45–60 seconds): Walk through OPTIONS sent before non-simple requests (custom headers, PUT/DELETE/PATCH, non-simple content-type); Access-Control-Max-Age caches the preflight as a story: what runs, what breaks, what you log/measure.
Pitfall (15 seconds): Call out Adding a custom Authorization header and not allowing it in Access-Control-Allow-Headers, causing the preflight to fail silently — interviewers reward honesty about real bugs.
Finish (15–20 seconds): Add List what makes a request 'simple' vs preflighted per the Fetch spec, and how Access-Control-Max-Age reduces preflight traffic, then offer a trade-off question back (“do you optimize for TTFB or TTI here?”).
CORS Preflight OPTIONS Request — When & Why It's Triggered
Direct Answer
What is a CORS preflight (OPTIONS) request? When is it triggered?
In one line: name the mechanism, where it applies (the browser pipeline, framework hooks, and user-visible outcomes), and the user-visible outcome.
Interviewers dig into: OPTIONS sent before non-simple requests (custom headers, PUT/DELETE/PATCH, non-simple content-type); Access-Control-Max-Age caches the preflight.
Classic weak answer: Adding a custom Authorization header and not allowing it in Access-Control-Allow-Headers, causing the preflight to fail silently.
Senior finish: List what makes a request 'simple' vs preflighted per the Fetch spec, and how Access-Control-Max-Age reduces preflight traffic.
Common Mistakes & Pitfalls
Adding a custom Authorization header and not allowing it in Access-Control-Allow-Headers, causing the preflight to fail silently
Check your understanding
Answer these without looking back at the article.
- What makes a CORS request 'simple' (no preflight)?
- What is Access-Control-Max-Age?
- Why do custom headers trigger a preflight?
- How do you debug a failing preflight?
Looking for a structured roadmap?
Every module on this page is also part of the full Java backend interview track.