Paulo Lopes

The CORS spec is defined here: https://fetch.spec.whatwg.org/#http-cors-protocol The ambiguity is here: https://fetch.spec.whatwg.org/#http-responses > Ultimately server developers have a lot of freedom in how they handle HTTP responses and these tactics...

To complement the comment above, in MDN we can see: https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS/Errors/CORSMethodNotFound Browser behavior is expected to block requests if the preflight request includes a list of allowed methods. The issue...

The 403 comes from here: > Any other kind of HTTP response is not successful and will either end up not being shared or fail the [CORS-preflight request](https://fetch.spec.whatwg.org/#cors-preflight-request). ... ....