Preflight requests behavior in Express - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is a preflight request in the context of CORS?

A preflight request is an HTTP OPTIONS request sent by the browser before the actual request. It checks if the server allows the real request with specific methods and headers.

beginner

Which HTTP method is used for preflight requests?

The HTTP OPTIONS method is used for preflight requests to ask the server about allowed methods and headers.

intermediate

How does Express handle preflight requests by default?

Express does not handle preflight requests automatically. You need to add middleware like 'cors' to respond properly to OPTIONS requests.

intermediate

What headers are important in a preflight request and response?

Important headers include 'Access-Control-Request-Method' and 'Access-Control-Request-Headers' in the request, and 'Access-Control-Allow-Methods' and 'Access-Control-Allow-Headers' in the response.

beginner

Why is handling preflight requests important in Express apps?

Handling preflight requests ensures browsers can verify permissions before sending actual requests, preventing CORS errors and enabling cross-origin communication.

Which HTTP method does the browser use to send a preflight request?

A OPTIONS

B GET

C POST

D PUT

Preflight requests always use the OPTIONS method to check server permissions before the actual request.

In Express, what middleware is commonly used to handle CORS and preflight requests?

A express-session

B body-parser

C cors

D helmet

The 'cors' middleware automatically handles CORS headers and preflight OPTIONS requests.

Which header does the browser send to specify the HTTP method it wants to use in the actual request during preflight?

A Access-Control-Expose-Headers

B Access-Control-Allow-Methods

C Access-Control-Allow-Origin

D Access-Control-Request-Method

'Access-Control-Request-Method' tells the server which method the actual request will use.

What should the server include in the response to a preflight request to allow a POST method?

A Access-Control-Allow-Methods: POST

B Access-Control-Allow-Origin: POST

C Access-Control-Request-Method: POST

D Access-Control-Allow-Headers: POST

'Access-Control-Allow-Methods' lists allowed methods like POST in the preflight response.

If an Express app does not handle preflight requests, what will happen when a browser sends a cross-origin request with custom headers?

A The request will succeed without issues

B The browser will block the request due to CORS error

C The server will automatically respond with CORS headers

D The browser will ignore CORS and send the request

Without proper preflight handling, the browser blocks the request to protect security.

Explain what a preflight request is and why it is important in Express applications.

Think about how browsers ask servers if they can send certain requests.

Describe the key headers involved in preflight requests and responses.

Focus on headers that specify methods and headers allowed.