| 触发条件 | 方法非 GET/HEAD/POST，或 Content-Type 非三类简单类型，或带自定义头 |
|---|---|
| 预检报文 | Origin + Access-Control-Request-Method + Access-Control-Request-Headers |
| 通过条件 | 204/200 且返回匹配的 ACAO/ACAM/ACAH |
预检交互示例
预检交互示例
OPTIONS /api/data HTTP/1.1
Origin: https://app.example.com
Access-Control-Request-Method: PUT
Access-Control-Request-Headers: content-type, x-token
HTTP/1.1 204 No Content
Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Methods: GET, PUT
Access-Control-Allow-Headers: content-type, x-token
Access-Control-Max-Age: 600预检失败 ≠ 接口故障：浏览器控制台会明确报 CORS 错，服务端日志甚至看不到真实请求；先解决 OPTIONS 响应。