What triggers a CORS preflight (OPTIONS) request, and what happens if it fails?

A preflight is triggered for 'non-simple' requests — those using methods other than GET/HEAD/POST-with-simple-content-type, or including custom headers like Authorization. If the server doesn't respond to the OPTIONS request with the correct Access-Control-Allow-* headers, the browser blocks the actual request entirely and it never reaches your controller — even though tools that don't enforce CORS (like Postman) would succeed.