Also highlights an aspect of CORS that is occasionally misunderstood. The client sends the request no matter what. The response headers dictate whether the response is usable.
This also means if you rely on CORS to prevent XSRF attacks (which is maybe not the best idea), you must be ensuring that any request that came in would have been preflighted (for example, reject requests unless they have a special header)
"Preflight check" is such a wrong analogy, since with CORS you fly all the way to the destination to check if you're allowed to fly to the destination.
*cargo isn’t really the right analogy… but close enough
Nah, the whole thing is just a "Can I ask you a question?" implemented in code.
addendum: one can rarely state anything entirely accurate about CORS briefly.