Simple cross-origin requests, such as a basic GET, are sent straight away. Anything beyond that triggers a preflight first: a method such as PUT or DELETE, a JSON content type, or a custom header such as Authorization. The browser sends OPTIONS with the Origin, Access-Control-Request-Method and Access-Control-Request-Headers headers, and waits for the server's answer.
The server replies with Access-Control-Allow-Origin, Access-Control-Allow-Methods and Access-Control-Allow-Headers. If the answer does not cover the planned request, the browser never sends it and logs a CORS error. The Access-Control-Max-Age header lets the browser remember the answer for a while so that it does not ask every time.
Preflight errors are one of the most common problems when a frontend and an API live on different domains, and the quick fix an AI tool suggests is often to allow every origin, method and header. That makes the error disappear by removing the restriction. Instead, answer OPTIONS requests with the specific origin, methods and headers your frontend needs, and remember that a preflight protects browsers only, so every endpoint still needs real authentication.
OPTIONS /api/orders HTTP/1.1
Origin: https://app.example.com
Access-Control-Request-Method: DELETE
Access-Control-Request-Headers: authorization
HTTP/1.1 204 No Content
Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Methods: GET, POST, DELETE
Access-Control-Allow-Headers: authorization, content-type
Access-Control-Max-Age: 600