如果请求是同源但不遵循 header 指南，是否会触发预检请求？

Question

From: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#preflighted_requests

The following is an example of a request that will be preflighted:

 const xhr = new XMLHttpRequest(); xhr.open('POST', 'https://bar.other/resources/post-here/'); xhr.setRequestHeader('X-PINGOTHER', 'pingpong'); xhr.setRequestHeader('Content-Type', 'application/xml'); xhr.onreadystatechange = handler; xhr.send('<person><name>Arun</name></person>');

The example above creates an XML body to send with the POST request. Also, a non-standard HTTP X-PINGOTHER request header is set. Such headers are not part of HTTP/1.1, but are generally useful to web applications. Since the request uses a Content-Type of application/xml , and since a custom header is set, this request is preflighted.

Will a preflight request be triggered if the request is same-origin but does not follow the header guidelines?

Answer 1

No, preflight requests are only done for cross-site requests. If you look at the beginning of the MDN article there is an image that explicitly says "Same origin-requets (always allowed)" as an example.

The below image isn't very visible if running SO in dark mode, if so, check the image in the article on the url below.

https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS