CORS Preflight
Browser-issued OPTIONS request that checks cross-origin permissions before the actual call.
Core Idea
A CORS preflight is an automatic OPTIONS request sent by the browser before specific cross-origin calls. It carries Access-Control-Request-* headers describing the upcoming request, and the server must answer with matching Access-Control-Allow-* headers. When the response is missing or mismatched, the browser blocks the real request before it can even reach your API logic.
Why It Matters Here
FastAPI relies on CORSMiddleware to craft correct preflight responses, including max_age so the browser can cache the outcome. Understanding preflight timing explains why you should add security headers and rate limits after CORS: if preflight fails, the rest of your protective layers never run.