Cache your CORS
This is a good practical article. One minor clarification:> cross-origin API requests will require these preflight requests, notably including: … Any request including credentialsNo, setting XMLHttpRequest’s withCredentials:true and fetch’s credentials:"include" to send the user’s Cookie with the request does not imply that a preflight request must be made, since  and  sent the Cookie with cross-site requests (back in the CSRF days when the default Cookie SameSite flag was effectively SameSite=None). Maybe he was referring to a custom header such as Authorization, which does trigger prefetch.