Preflight request

A preflight request is the browser asking permission before it makes certain cross-origin JavaScript calls. Before sending the real request, the browser sends an OPTIONS request to the target URL describing what it intends to do - the origin the page is on, the HTTP method, and any non-standard headers. The server answers with CORS headers saying whether that combination is welcome. Only if the answer approves does the browser send the actual request; otherwise the call fails before any data leaves the page.

Not every cross-origin request is preflighted. "Simple" requests - including a plain urlencoded form post - skip it, which is why an old-fashioned HTML form can submit anywhere without ceremony. The moment JavaScript sends Content-Type: application/json or adds custom headers, the request stops being simple and the preflight kicks in.

For developers, the practical consequence is that a JSON API used from the browser must answer OPTIONS correctly, or every fetch to it will die with a CORS error that looks mysterious and is actually the preflight being refused. The mechanism is invisible when configured well and loud when it is not.

SheetLink Forms endpoints answer preflights according to each form's origin allowlist. An AJAX or JSON submission to https://sheetlinkforms.com/f/{token} from an allowlisted origin gets its preflight approved and proceeds; a request from an unlisted origin is refused, and a blocked submission surfaces as a 403. Plain HTML form posts are simple requests and never preflight, which is why the allowlist is one layer of defense rather than the whole story.

Response codes and CORS behavior are covered in the developer docs, and the allowlist's place in the spam stack on the security page.