title: Why doesn't pre-flight CORS block CSRF attacks?
body: <p><a href="https://stackoverflow.com/questions/19793695/does-a-proper-cors-setup-prevent-xsrf">Everyone</a> says CORS doesn't do anything to defend against CSRF attacks. This is because CORS blocks outside domains from accessing (reading) resources on your domain -- but <em>doesn't</em> prevent the request from being processed. So evil sites can send state-changing DELETE requests, without caring that they can't read back the result.</p>
  
  <p>That's all well and good.</p>
  
  <p>Except for <a href="https://spring.io/understanding/CORS#pre-flight-requests" rel="nofollow noreferrer">pre-flight CORS</a>.</p>
  
  <p>In this case, CORS looks at the request BEFORE it is sent, and checks whether it's legitimate. If it's not, the request is rejected. </p>
  
  <p>So the DELETE request that the CSRF attacker tries to send fails the pre-flight check, and thus is rejected. The CSRF attack fails.</p>
  
  <p>What am I missing here?</p>