Observe a CORS preflight

Prediction

Without matching cached preflight permission, adding the fixed non-safelisted request field makes the browser send OPTIONS before the intended request.

Controlled observation

Compare the fixed simple GET with the POST that carries one non-safelisted field. The result panel shows only the final Fetch response. Use browser developer tools to inspect the automatically generated OPTIONS exchange separately.

Run the POST first in a fresh browser context, then repeat it with the network log preserved. This Lab advertises Access-Control-Max-Age: 600, allowing preflight permission to be cached for up to 600 seconds. Browsers may impose a shorter limit or evict the permission earlier. A repeat run may show only POST because the browser reuses a matching cached grant.

To observe a fresh preflight again, use a new isolated browser context, such as a separate browser profile. Reloading the page does not guarantee a new OPTIONS exchange.

Explanation

Preflight asks whether an origin may use the intended method and fields. A successful HTTP response still needs compatible CORS sharing fields. Preflight permissions have their own cache; seeing no new OPTIONS on a repeat request does not mean the non-safelisted field stopped requiring permission.

HTTP/1.1 200 OK
Content-Type: application/json
X-Lab-Scenario: cors-simple

{"fixture":"simple","scenario":"cors-preflight"}

'curl' '--include' '--request' 'GET' 'https://lab.httpclarity.com/v1/cors-preflight/simple'

const response = await fetch("https://lab.httpclarity.com/v1/cors-preflight/simple", {
  "method": "GET"
});
console.log(response.status, await response.text());

<?php
$options = ['http' => [
    'method' => 'GET',
    'ignore_errors' => true,
]];
$context = stream_context_create($options);
$body = file_get_contents('https://lab.httpclarity.com/v1/cors-preflight/simple', false, $context);
var_dump($http_response_header, $body);