Learn what triggers an HTTP OPTIONS preflight request, why browsers send it, how to handle it on the server, and how to reduce API latency with Access-Control-Max-Age caching.
Frequently Asked Questions
Q1. Why does my application make two requests for every one API call?
When your frontend sends a request with Content-Type: application/json or an Authorization header, the browser automatically sends an HTTP OPTIONS preflight request first to verify permissions before sending your real POST or PUT request.
Q2. What HTTP status code should an OPTIONS preflight return?
The standard recommended status code is HTTP 204 No Content. An HTTP 200 OK with an empty body is also acceptable.
Q3. What is the maximum value for Access-Control-Max-Age?
Chromium browsers (Chrome, Edge, Brave) cap Access-Control-Max-Age at 7200 seconds (2 hours). Firefox supports up to 86400 seconds (24 hours). Setting it to 86400 is common practice.