In which cases is a preflight (OPTIONS) request sent?

The preflight (OPTIONS) request is automatically sent by the browser before the main CORS request in the following cases:

• When the HTTP method differs from simple ones (GET, POST, HEAD), for example, PUT, DELETE, PATCH.
• If non-standard headers are used (for example, Authorization, Content-Type with a type other than application/x-www-form-urlencoded, multipart/form-data, or text/plain).
• If the Content-Type is not one of the simple types (application/x-www-form-urlencoded, multipart/form-data, text/plain).

The purpose of the preflight request is to check with the server whether it allows cross-origin requests with such methods and headers. The server should respond with the necessary CORS headers, such as Access-Control-Allow-Methods and Access-Control-Allow-Headers.

Example: if the frontend tries to send a request with the PUT method and an Authorization header, the browser will first send an OPTIONS request to ensure that the server permits such a request.

This is a security mechanism to prevent unwanted requests from other domains.