1

According to MDN documentation, every non-simple request is doomed to fall into an infinite recursion:

  1. I want to send a non-simple CORS request (with the verb PUT e.g.)
  2. My browser tries to send a CORS preflight request for the request above because it is a PUT which needs to be preflighted. (so far so good)
  3. My browser tries to send another CORS preflight request for the request above because the preflight request itself is an OPTIONS which needs to be preflighted. (what a terrible failure)
  4. My browser tries to send another CORS preflight request for the request above because the preflight request itself is an OPTIONS which needs to be preflighted.
  5. My browser tries to send another ...

but it isn't and must not. It's obvious that I got it wrong at #3.

What am I missing here?

|improve this question
  • 2
    I think it falls into the What request use CORS part: the preflight CORS request is not part of it, so it's not concerned by using CORS. – Xenos Jun 20 '18 at 9:58
  • 1
    The browser never makes more than one preflight OPTIONS request. If it makes a preflight OPTIONS request that doesn’t succeed, then the browser stops right there and never makes any more requests — including not even trying the PUT request from your code. That behavior is mandated by the CORS protocol requirements (defined in the Fetch spec). In other words, the reason one CORS preflight doesn’t cause another is, the spec says it doesn’t. It’s just not how the CORS protocol works. – sideshowbarker Jun 20 '18 at 16:39
  • I see. I focused on the verb too much missing out more basic things. Thank you guys! – Attacktive Jun 21 '18 at 0:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.