Should I expect OPTIONS preflight with all CORS requests?

Question

I have two types of CORS requests configured on the client side. One implements the GET method and the other implements POST.

After the initial preflight OPTIONS is issued with the first GET, the subsequent GETs and POSTs (configured nearly identically using the jQuery Ajax object) are not preceded by the preflight.

I do not see the OPTIONS preflight going out prior to subsequent requests when I monitor the Chrome Network panel.

Once the browser has verified what Methods and Origin are accepted by the server, and once that first preflight has been accepted, does the browser not send any following preflights, since CORS communication has been established between it and the server?

Answer 1

The preflight request is always required, but it can be cached by the browser if the server allows it to do so. The server responds with a Access-Control-Max-Age header that specifies how long in seconds the preflight request can be cached. So, if you don't see the OPTIONS request, it must have been cached by the browser.