What is CORS; what is a preflight (OPTIONS) request for?

Short answer

CORS (Cross-Origin Resource Sharing) is the controlled relaxing, with the server's permission, of the same-origin restriction that the browser applies to requests made from a page to another origin (a different scheme, domain or port). The server states the origins, methods and headers it allows with the Access-Control-Allow-* response headers; before non-simple requests (PUT, DELETE or requests that contain a custom header), the browser sends a preflight OPTIONS request to ask whether the actual request is allowed. In TR7, this is done with the CORS action: the default value of the Allowed Methods, Allowed Origins and Allowed Headers fields is *; OPTIONS requests that carry an Origin header are answered with 204 No Content without being sent to the Backend Service, and Access-Control-Allow-Origin is added to the response of the other requests coming from an allowed origin. For requests without an Origin header, the action does nothing.

Where It Is Used in TR7

Where	Field / label	What for
Load Balancer → Actions (Policy Actions) → action form	Action Type → CORS	Defining the CORS behavior
CORS action form	Allowed Methods (default *)	The Access-Control-Allow-Methods value in the preflight response
CORS action form	Allowed Origins (default *)	The origins for which Access-Control-Allow-Origin is added
CORS action form	Allowed Headers (default *)	The Access-Control-Allow-Headers value in the preflight response
Load Balancer → Load Balancer vService List → HTTP vService form	Actions	Binding the CORS action to the vService

How Does the CORS Action Respond in TR7?

Request	TR7's behavior
No Origin header	The action does not come into play; the request and the response pass unchanged.
OPTIONS with an Origin header (preflight)	Not sent to the Backend Service; 204 No Content is returned. The response contains Access-Control-Allow-Methods, Access-Control-Allow-Headers and Access-Control-Max-Age: 600; if the origin is allowed, Access-Control-Allow-Origin is added too.
Other requests with an Origin header	Forwarded to the Backend Service; if the origin is allowed, Access-Control-Allow-Origin is added to the response.

If there is no * in the Allowed origins list, Vary: Accept-Encoding,Origin is also added to the response given to an allowed origin. The Access-Control-Allow-Credentials and Access-Control-Expose-Headers headers are not produced by this action (behavior details under Allowed Headers).

Common Misconceptions

• "CORS protects the server against attacks." CORS is a rule applied by the browser; non-browser clients (scripts, API tools) are not subject to this restriction. For server-side protection, WAF is used.
• "TR7 returns an error to a preflight from an origin that is not allowed." TR7 still returns 204 to the preflight; it simply does not add the Access-Control-Allow-Origin header, and the browser blocks the actual request.
• "Values can be written with a space after the comma." The list is written with commas and without spaces; when it is written with spaces (a.com, *), * is not recognized as a wildcard (Allowed Origins).
• ".example.com also covers the main domain." This notation covers only subdomains; a separate entry is needed for example.com.

How it is done in the documentation

• CORS · What Is CORS?
• CORS · Preflight Requests
• CORS · Allowed Origins
• CORS · Allowed Headers

Related questions

• What are HTTP methods (GET, POST, PUT, DELETE…)?
• What is an HTTP Header?
• Can I allow only certain HTTP methods on a page (Allowed Methods)?