Cache your CORS
Unfortunately this caching is still per-path. For example:<p><pre><code>    GET /v1/document/{document-id}/comments/{comment-id}
</code></pre>
For every new document-id or comment-id, there will be a new pre-flight request.<p>Alternative hacks: Offer a variant of your API format that either<p>1. Moves the resource path to the request body (or to a header that is included in "Vary"). Though the rest of your stack (load balancing, observability, redaction) might not be ok with this, e.g. do your WAF rules support matching on the request body? You also will no longer get automatic path-based caching for GET requests.<p>2. Conforms to the rules of a CORS "simple" request [1], which won't trigger a pre-flight request. This is what we did on the Dropbox API [2]. You'll need to move the auth information from the Authorization header to a query parameter or the body, which can be dangerous wrt redaction, e.g. many tools automatically redact the Authorization header but not query parameters.<p>[1] <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests" rel="nofollow">https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simpl...</a><p>[2] <a href="https://www.dropbox.com/developers/documentation/http/documentation" rel="nofollow">https://www.dropbox.com/developers/documentation/http/docume...</a> (see "Browser-based JavaScript and CORS pre-flight requests")