How CORS Preflight Requests Prevent Unsafe Cross-Origin Operations

Browsers use preflight requests to ask server permission before sending cross-origin requests that could modify data. An OPTIONS request is sent first with headers like Access-Control-Request-Method; if the server responds with appropriate CORS headers, the actual request proceeds. This mechanism prevents sensitive operations like DELETE or PUT from being executed before CORS checks complete.