Cache your CORS
This is a good practical article. One minor clarification:<p>> cross-origin API requests will require these preflight requests, notably including: … Any request including credentials<p>No, setting XMLHttpRequest’s withCredentials:true and fetch’s credentials:"include" to send the user’s Cookie with the request does <i>not</i> imply that a preflight request must be made, since <script> and <form> sent the Cookie with cross-site requests (back in the CSRF days when the default Cookie SameSite flag was effectively SameSite=None). Maybe he was referring to a custom header such as Authorization, which does trigger prefetch.