[HTTP] Origins, CROS, Preflight

Origins made up of three parts the data scheme, the hostname and the prot.

It is important to know that it is user broswere enforces the same origin policy, it is the client browser not allow you send the different origin request not the server.

CROS:



Client side send the request, server side will check wheterh "Access-Control-Allow-Origin" is the same as "Referer".

One problem for this is request is already send to server, include all the data. What we want is from client side, we just sent the min-info to check the CROS, instead of sending business data.

So there is Preflight request comes in to play.

Preflight request:



It sends OPTIONS methoda and with "Referer", so server only needs to check "Referer" and return "ACAO".

To check whether a request is a Preflight request, you need to see whether it has "OPTIONS" method in the request head.

But notice, if a request is come from a form , then it cannot be preflight. See MORE