> * This is how to use CORS without Preflights: http://homakov.blogspot.com/2014/01/how-to-use-cors-without-...

Am I misreading, or is the thing you link to a proposal for what user-agents should do, rather than a technique that works now? Ah, I see you are the author of what you linked to, so maybe I am misreading?

(Also, are there secruity concerns with first making the request, and only finding out after you made it if you were allowed to make it? Seems like for POST requests (or GET requests on badly implemented apps), the request alone can be dangerous, even if the browser refuses to share the response with the script after seeing the response headers)

I proposed two techniques, putting all headers in Accept (works now) and allowing CORS-* headers by default (just a proposal)