Hacker News Reader

Yep, you've got to be careful with browser HTTP requests! Conveniently on this very same site I built a CORS tool that knows all those rules and can tell you how they work for every case: https://httptoolkit.tech/will-it-cors/

I see this a lot as an anti CSRF technique in AJAX based SPAs.

yeah, those techniques predate CORS, but even back then, you'd typically add your anti-csrf token to the payload rather than the header. CSRF is application level logic rather than protocol level.

> they will force a preflight request

That's why they're so great. use a custom header and never worry about CSRF issues.

Use custom header and be sure that if request comes from the browser it was made by legitimate code from your origin.