Devsolved
The Symptom
Symptom
After migrating our frontend to a new domain, users reported the app felt sluggish. Monitoring tools showed our API Gateway traffic had exactly doubled overnight. However, Google Analytics showed our active user count remained completely flat.
Root Cause Analysis
Root Cause
Because the frontend and backend were now on different domains, the browser engaged Cross-Origin Resource Sharing (CORS) protections. Before sending a `POST` or `PUT` request with custom headers (like `Authorization`), the browser sends a preflight `OPTIONS` request to ask the server for permission. Our backend responded with `Access-Control-Allow-Origin: *`, but we failed to include an `Access-Control-Max-Age` header. By default, Chromium caches preflight responses for only 5 seconds. This meant that every time a user navigated the app, the browser was firing duplicate OPTIONS requests, doubling network latency (due to round trips) and artificially inflating our server load.
Code
javascript
// The fatal flaw: Express CORS middleware defaults
app.use(cors({
origin: 'https://app.devsolved.com',
methods: ['GET', 'POST', 'PUT']
// Missing maxAge!
}));Resolution
Resolution
We updated our CORS middleware to include `Access-Control-Max-Age: 86400` (24 hours). Now, the browser makes a single OPTIONS request when the user first opens the app, caches the permission, and sends all subsequent API calls directly, instantly cutting our backend traffic by 50% and improving perceived app performance.
Discussions 0