The CORS spec states that if a request method and headers are not simple (http://www.w3.org/TR/cors/#simple-cross-origin-request) then a preflight HTTP OPTIONS request is sent to see if the request is allowed by the server.
My server does not respond with any CORS specific headers, so I am assuming this means the request will be denied. A security firm recently told me that this means the request will always be accepted if I don't specifically deny it with CORS headers, but I find this hard to believe.
Also, some older browsers don't implement CORS at all, so I am wondering if there is a security hole here that these browsers may be able to bypass the CORS check? Or do these browsers just always deny everything?
Summary: I never want cross origin requests to be accepted. Is there a security hole with just pretending CORS doesn't exist?