What is the difference between simple and complex (preflight) requests in the context of CORS?

In the context of CORS (Cross-Origin Resource Sharing), there are simple and complex (preflight) requests:

• Simple requests are HTTP requests that meet certain conditions:

  • Request method: GET, POST, or HEAD
  • Headers are limited to a set: Accept, Accept-Language, Content-Language, Content-Type (with values application/x-www-form-urlencoded, multipart/form-data, or text/plain)
  • No custom headers

  Such requests are sent directly by the browser, and the server responds with the necessary CORS headers.

• Complex (preflight) requests are requests that do not meet the criteria of simple requests. For example, if the method PUT, DELETE, or custom headers are used, or if Content-Type is different from the above.

  In this case, the browser first sends a preflight request — an OPTIONS request to the server to check if the main request is allowed. The server must respond with headers permitting this method and headers.

Example:

If you make a POST with Content-Type: application/json, the browser will first send an OPTIONS (preflight) request, and only after a successful response will it perform the main request.

This is a security mechanism to prevent unwanted cross-domain requests.