What Is a Simple Request and When Does the Browser Send a Preflight Request?

In the previous article, we learned that browsers sometimes send an OPTIONS request before the actual Cross-Origin request. This process is known as a CORS Preflight Request. But does this happen for every request? The answer is no. Browsers only perform a Preflight Request when the request does not qualify as a Simple Request.

What Is a Simple Request?

A Simple Request is a Cross-Origin request that satisfies a specific set of conditions defined by the Fetch specification. Since these requests are considered low risk, the browser sends them directly without performing a Preflight check. CORS rules still apply to the response, but no preliminary OPTIONS request is needed.

Requirements for a Simple Request

A request is considered simple only if all of the following conditions are met.

1. HTTP Method

The request method must be one of:

• GET
• HEAD
• POST

Methods such as PUT, PATCH, and DELETE automatically trigger a Preflight Request.

2. Request Headers

The request may only include CORS-safelisted request headers, such as:

• Accept
• Accept-Language
• Content-Language

Adding headers like Authorization: Bearer <token> or X-API-Key: 123456 causes the browser to perform a Preflight Request.

3. Content-Type

If the request has a body, its Content-Type must be one of:

• application/x-www-form-urlencoded
• multipart/form-data
• text/plain

Using a content type such as application/json makes the request non-simple and triggers a Preflight Request. This is one of the most common reasons developers see OPTIONS requests in modern web applications.

Examples

This request is simple:

fetch("/users")

No Preflight Request is sent.

This request is also simple:

fetch("/login", {
  method: "POST",
  headers: { "Content-Type": "text/plain" }
})

Again, no Preflight is required.

However, this request is not simple:

fetch("/login", {
  method: "POST",
  headers: { "Content-Type": "application/json" }
})

The browser first sends an OPTIONS request.

The same happens here:

fetch("/profile", {
  headers: { "Authorization": "Bearer token" }
})

Because the Authorization header is not CORS-safelisted, a Preflight Request is required.

Summary

A browser sends a Preflight Request only when a Cross-Origin request does not meet the requirements of a Simple Request. The most common triggers are:

• Using methods such as PUT, PATCH, or DELETE
• Including non-safelisted headers such as Authorization
• Using content types like application/json

This is why seeing an OPTIONS request before the actual request is completely normal in many modern APIs.