1

Recently, I was reading about preflight request(OPTIONS) and got to know that it is always triggered when content-type is "application/json" or some other except "text/plain" ,"application/x-www-form-urlencoded" & "multipart/form-data Content-Types"

So my question is why it is always getting triggered for specific content-type like "application/json" not for above mentioned content-type .

1 Answer 1

3

Simple requests

A simple cross-site request is one that meets all the following conditions: The only allowed methods are:

GET
HEAD
POST

Apart from the headers set automatically by the user agent (e.g. Connection, User-Agent, etc.), the only headers which are allowed to be manually set are:

Accept
Accept-Language
Content-Language
Content-Type

The only allowed values for the Content-Type header are:

application/x-www-form-urlencoded
multipart/form-data
text/plain

Preflighted requests

Unlike simple requests (discussed above), "preflighted" requests first send an HTTP request by the OPTIONS method to the resource on the other domain, in order to determine whether the actual request is safe to send. Cross-site requests are preflighted like this since they may have implications to user data. In particular, a request is preflighted if:

  • It uses methods other than GET, HEAD or POST. Also, if POST is used to send request data with a Content-Type other than application/x-www-form-urlencoded, multipart/form-data, or text/plain, e.g. if the POST request sends an XML payload to the server using application/xml or text/xml, then the request is preflighted.
  • It sets custom headers in the request (e.g. the request uses a header such as X-PINGOTHER)

Hope this answers your question else please make a comment.

Source

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.