dotvitals

Preflight results are not cached

InfoConfirmedweb.cors.preflight-not-cached

What this check looks for

Before most cross-origin calls the browser asks permission with a separate request. Nothing here tells it how long that answer is good for, so it asks again every single time.

Why it matters

Nothing is wrong and nothing is exposed. It is a performance note: every preflighted call costs a full extra round trip, which is most visible on a mobile connection or from a region far from the server.

When the check passes, your report says: “Preflight results are cached, so permission is asked once”.

What it costs your score

This check never deducts. It reports a fact — or reports that something could not be verified — and is shown on the report without moving the score.

Severity
info
Default confidence
confirmed
Status when triggered
info
Deduction
0 points
Family cap
none
Category
Web security
Module
Web cors
Fix owned by
user
In the ruleset since
2026.09

How the whole score is calculated

Technical detail

Access-Control-Max-Age: ‹max age› on the preflight response from ‹origin›, or no such header at all.

Without it browsers fall back to a short default — five seconds in Chromium, and the header is capped there at 7200 seconds (two hours) regardless of what you send; Firefox caps it at 86400. Values above those caps are not wrong, they are simply clamped.

The cache is keyed per origin, per URL and per method, so it helps a chatty front end far more than an occasional call. Raise it only once the policy is settled: while it is cached, a browser will not notice that you tightened the allowed methods or headers, which makes a long max-age mildly awkward during a rollout and harmless afterwards.

Standards and references

Test this on your domain

Run the check that produces this finding, on its own, against any domain.

Open the web cors checker

Other web cors checks