Skip to content

.tip

· one of the small things

Cache the CORS preflight with Access-Control-Max-Age

A cross-origin request that carries Authorization or Content-Type: application/json gets an OPTIONS preflight first. Without Access-Control-Max-Age the browser repeats that preflight before every call, so each API request costs two round trips.

Access-Control-Allow-Methods: GET, POST, PATCH
Access-Control-Allow-Headers: authorization, content-type
Access-Control-Max-Age: 7200

Chromium caps the value at 7200 seconds, so asking for a day gets you two hours. Send the headers on the OPTIONS response itself, not only on the real one.

httpperformance