How can I identify a CORS preflight request?

Question

A CORS preflight request obviously uses the OPTIONS method and has an Origin header. However, a browser can decide for any HTTP request to add an Origin header. Also, O

Answer 1

Check for the Access-Control-Request-Method header. It would not make much sense to send it in a request other than the preflight request.