CORS preflight
Extra OPTIONS request the browser sends before "non-simple" cross-origin calls to ask the server whether the operation is allowed. Triggers: custom headers, methods beyond GET/POST/HEAD, Content-Type beyond form-encoded.
Flow: 1) browser → OPTIONS with Access-Control-Request-Method + Headers, 2) server responds with Access-Control-Allow-Origin + Allow-Methods + Allow-Headers (+ Max-Age for caching), 3) actual request goes through. Performance hit: preflight costs 1 round-trip. Mitigation: cache via Access-Control-Max-Age (default 5s in Chrome, 24h in Firefox). Common pitfall: the server doesn't return an OPTIONS handler → preflight fails → CORS error without a clear signal why. fetch error messages are vague; the DevTools network tab shows the OPTIONS failure.