Why Does CORS Allow GET Requests Without a Preflight Check?
CORS allows standard GET requests without a preflight check for backward compatibility with the legacy web. Because HTML tags like `<form>`, `<img>`, and `<script>` have always been able to issue cross-origin GET requests without pre-approval, requiring preflights for all GETs would have broken decades of existing web architecture.
Detailed Technical Explanation
Before CORS existed, web browsers permitted HTML forms to submit cross-origin GET and POST requests. The Same-Origin Policy only prevented client JavaScript from reading the returned response, not from sending the request itself. When the W3C drafted CORS, they designated these historical interactions as "Simple Requests." A request is simple if it uses a safe method (GET, HEAD, POST) with standard headers (`Accept`, `Content-Type: text/plain`, `multipart/form-data`, or `application/x-www-form-urlencoded`). Because web servers were already built to withstand these cross-origin requests, preflighting them was deemed unnecessary.
Technical Example & Code
Adding a custom header forces the browser to send an OPTIONS preflight even for a GET method.
// 1. Simple GET (NO preflight dispatched):
// Uses standard method, standard headers
fetch('https://api.example.com/data', {
method: 'GET',
headers: { 'Accept': 'application/json' }
});
// 2. Preflighted GET (Triggers OPTIONS preflight first):
// Adding a custom Authorization header makes it a non-simple request!
fetch('https://api.example.com/data', {
method: 'GET',
headers: {
'Authorization': 'Bearer token123',
'X-Custom-Client': 'WebDashboard'
}
});Why This Is the Case (Underlying Architectural Rationale)
"The web platform enforces a strict backward compatibility invariant: newly introduced security specifications must not break legacy servers deployed prior to the standard. Since servers built in the 1990s and 2000s already handled direct cross-origin GET queries from links and forms, adding preflight checks to simple requests would have generated massive latency and crashed older infrastructure."
Common Misconception vs Reality
"CORS blocks cross-origin GET requests from reaching the server."
Simple GET requests reach the server and execute normally; CORS merely prevents the calling client JavaScript from reading the HTTP response body if the server omits Access-Control-Allow-Origin.
Related Curious-Techie Resources
Ultimate Guide to CORS & Web Security Architecture →
Master simple requests, preflight handshakes, credential modes, and origin validation.
Interactive ToolCORS Checker & Header Builder →
Simulate cross-origin fetch requests and inspect preflight OPTIONS response headers.
Developer ReferenceCORS Headers Reference & Directives →
Related Questions in the Q&A Knowledge Base
Browsers send preflight OPTIONS requests to check whether a cross-origin server understands modern CORS protocols and permits the requested HTTP method, custom headers, or credentials before sending the actual state-changing payload.
You should not store authentication JWTs in localStorage because any Cross-Site Scripting (XSS) vulnerability on your page allows malicious JavaScript to instantly read and exfiltrate the token. Storing tokens in HttpOnly, Secure, SameSite cookies protects them from JavaScript access.
Using 'unsafe-inline' in a Content Security Policy defeats XSS protection because it instructs the browser to execute any inline script found in the HTML. Since Cross-Site Scripting works by injecting malicious inline script tags or event handlers, 'unsafe-inline' allows the attacker's payload to run freely.
Écosystème Technique Associé et Prochaines Étapes
Articles Techniques Associés
What Is CORS (Cross-Origin Resource Sharing)?
The standard protocol enabling controlled cross-origin data access in modern browsers.
CSP vs CORS: Differences in Browser Defense Mechanisms
Distinguishing outbound resource loading restrictions from inbound server access control.
Troubleshooting: No Access-Control-Allow-Origin Header Present
Diagnose and fix the most common browser cross-origin blocking error with production configs.
Laboratoires Pratiques de Diagnostic
Spécifications et Références Développeur
Poursuivre l’Apprentissage
CORS Policy & Preflight Handshake Lab
Simulate preflight OPTIONS probes and adjust Access-Control-Allow-* headers inside the browser sandbox.