security cors ai_generated true

CORS preflight succeeds but subsequent request fails with 403, or auth changes aren't reflected

ID: security/cors-preflight-cache-stale-auth

Also available as: JSON · Markdown
85%Fix Rate
88%Confidence
3Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
any active — — —

Root Cause

Access-Control-Max-Age caches preflight responses. If you change CORS config or auth requirements, browsers use the cached preflight result. Chrome caches for up to 2 hours. Users see 'CORS error' for changes that are actually deployed correctly.

generic

Workarounds

  1. 90% success Set Access-Control-Max-Age to a short value (300-600s) during development 
    response.headers['Access-Control-Max-Age'] = '300'  # 5 minutes, balances caching and flexibility
  2. 85% success Clear browser cache or use incognito mode to test CORS changes 
    Chrome DevTools -> Application -> Cache -> Clear storage. Or Ctrl+Shift+Delete -> Cached images and files.
  3. 92% success Include Vary: Origin header to prevent incorrect CORS response caching 
    response.headers['Vary'] = 'Origin'  # ensures different origins get correct CORS headers from CDN/proxy

Dead Ends

Common approaches that don't work:

  1. Deploy CORS change and test immediately in the same browser 88% fail

    Browser caches the old preflight response for Access-Control-Max-Age seconds (default varies by browser, up to 7200s in Chrome).

  2. Set Access-Control-Max-Age to a very high value for performance 82% fail

    High max-age means CORS config changes take hours to propagate to users. Auth requirement changes are invisible until cache expires.