And preflight must respond to OPTIONS.
As a browser, Chrome is incredibly strict about Cross-Origin Resource Sharing (CORS) for security reasons. While this is great for the average user, it is the absolute bane of a frontend developer’s existence when trying to hit a local API or a staging server. cors chrome
If you include credentials ( fetch(url, credentials: 'include' ) ), Chrome requires: And preflight must respond to OPTIONS