Company
Date Published
Author
Colin Sidoti
Word count
846
Language
English
Hacker News points
None

Summary

Clerk has developed a Frontend API that avoids triggering CORS preflight requests by ensuring all API requests qualify as "simple requests," which do not add security for modern applications and only serve to protect legacy systems. CORS preflights were originally designed to safeguard older applications from potential risks associated with browsers sending alternative request methods and custom headers, but they result in unnecessary latency for contemporary applications. Clerk uses polyfills to handle modern request methods and custom headers without preflights, by overriding methods with query strings and handling non-sensitive headers similarly, while sensitive information like authorization tokens is included within the request body. This approach not only bypasses the preflights but also reduces the extra network round-trip time, optimizing response times crucial for modern web applications.