CODEWITHSUNDEEP
phpcorspreflight
Giorgi Lagidze
Giorgi Lagidze

Reputation: 75

how to disable preflight request even with custom headers

I need someone who is so experienced with this and has outstanding knowledge so that he can advise me.I will explain my situation in detail. I've written a restful api. It's a super huge api and I am using front-end SPA (vue.js , doesn't matter for real) . There're many pages where I make 3-4 different api requests (fetching different information) . what really pisses me off is that preflight request takes place . which means that if going to one page needs 4 requests,it doesn't do 4 api requests,it makes 4 * 2 = 8 api requests because of preflight OPTIONS request. I don't need it , because I know about cors and I can set cors correctly so that before every request i don't need preflight to check if request is safe or not. (PREFLIGHT is a good,quick way (not optimal) to eliminate any threats that might come from a different domain to my domain if my domain has no idea about cors,so preflight will defend me and tell him that my domain doesn't know about cors and he can't make requests from another origin to my origin. I also gave you some information .

NOW It's time to disable it ,i know it doesn't take body with requests so that it might be quick but i still don't want it. and i want to disable it. I know it is possible . I read a lot in stackoverflow,people say you just have to set content-type to text/plain .or some other solutions,but they say if you use custom headers,then it's not possible . I use custom headers so that Authentication token (bearer) be passed to my api middleware. There must be a way to disable it somehow.

Thank you so much in advance and for any suggestions.

Upvotes: 3

Views: 4796

Answers (1)

roryhewitt
roryhewitt

Reputation: 4517

Ok, step one is to return the Access-Control-Max-Age response header from the preflight OPTIONS request. This specifies the length of time the OPTIONS response is cached in the browser. If you return this, then the browser will stop sending the preflight requests. Well, it will send one per request initially, but after that, it will use the cached version in your browser.

Upvotes: 3

Related Questions