A preflight request is a browser-generated cross-origin HTTP request that checks whether a later request is permitted before sending it. It appears when a web page calls an API from a different origin, making CORS configuration part of the developer workflow. section 3.4
Handle preflight behavior by configuring the API deliberately:
- Allow only expected origins, such as a local dashboard address, instead of using the wildcard origin by default. section 3.4 section 7.5.1
- Limit permitted methods to those the application uses, such as GET and POST; OPTIONS may be required by some frameworks or versions. section 3.4 section 7.5.1
- Declare allowed headers and decide whether credentials are permitted for authenticated, cookie-based, or stateful requests. section 3.4
Diagnosing a blocked dashboard request
A page served from http://localhost:3000 requests http://localhost:8000/health/status and receives a CORS error because the API response lacks Access-Control-Allow-Origin. Adding FastAPI's CORSMiddleware with the dashboard origin and GET permission supplies the required policy configuration. section 3.4
