Intermediate LevelWeb Security & Cyber Defense
How do Access-Control-Max-Age headers optimize CORS preflight performance safely?
❓ Interview Prompt: Explain CORS preflight `OPTIONS` overhead, `Access-Control-Max-Age` header, browser max-age caps, and performance tuning.
Sending a preflight 'OPTIONS' request before every 'POST', 'PUT', or 'DELETE' API call adds an extra network round-trip delay (~50-100ms):
'Access-Control-Max-Age' Solution:
Specifies the maximum time (in seconds) that the browser is permitted to cache the preflight 'OPTIONS' response:
•
'Access-Control-Max-Age: 86400' (Caches preflight results for 24 hours).
•
Browser Limit: Chromium caps max-age to 2 hours (7200s); Firefox allows up to 24 hours (86400s).
Code Implementation Example
http
HTTP/1.1 204 No Content
Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Max-Age: 7200💡Access-Control-Max-Age header caching preflight OPTIONS responses for 2 hours.
🎯 Interview Key Takeaway
Set Access-Control-Max-Age to cache CORS preflight OPTIONS responses and reduce network latency.
#CORS#Preflight#Access-Control-Max-Age#Intermediate
Back to all Web Security & Cyber Defense Questions→