title: How to avoid CORS preflight request on file upload?
body: <p>I am using jquery-fileupload to allow users to upload files to an external service (Cloudinary to be more specific):</p>
  
  <pre><code>&lt;input type='file' name='file' class='cloudinary-fileupload' 
    data-url='https://api.cloudinary.com/v1_1/wya/auto/upload' /&gt;
  &lt;script&gt;
    $('.cloudinary-fileupload').fileupload();
  &lt;/script&gt;
  </code></pre>
  
  <p>Since it is an external target, the browser initiates a CORS request. However, I noticed that the browser prepends a CORS preflight request. 
  <a href="http://www.html5rocks.com/en/tutorials/cors/" rel="noreferrer">http://www.html5rocks.com/en/tutorials/cors/</a> gives pretty good insights about when a preflight request is triggered and when not. As far as I see, my request fulfills all criteria for being a CORS simple request (see section <a href="http://www.html5rocks.com/en/tutorials/cors/#toc-types-of-cors-requests" rel="noreferrer">'Types of CORS requests'</a>).</p>
  
  <p>The <strong>file upload request</strong> that is sent to the external service:</p>
  
  <pre><code>POST /v1_1/wya/image/upload HTTP/1.1
  Host: api.cloudinary.com
  Connection: keep-alive
  Content-Length: 22214
  Accept: */*
  Origin: http://wya.herokuapp.com
  User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.107 Safari/537.36
  Content-Type: multipart/form-data; boundary=----WebKitFormBoundarym73rCIa6t8eTNkTa
  Referer: http://wya.herokuapp.com/
  Accept-Encoding: gzip,deflate,sdch
  Accept-Language: sv-SE,sv;q=0.8,en-US;q=0.6,en;q=0.4,de;q=0.2
  </code></pre>
  
  <p>The additional <strong>preflight request</strong> which is sent to the external service prior to the file upload request:</p>
  
  <pre><code>OPTIONS /v1_1/wya/image/upload HTTP/1.1
  Host: api.cloudinary.com
  Connection: keep-alive
  Access-Control-Request-Method: POST
  Origin: http://wya.herokuapp.com
  User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.107 Safari/537.36
  Access-Control-Request-Headers: accept, content-type
  Accept: */*
  Referer: http://wya.herokuapp.com/
  Accept-Encoding: gzip,deflate,sdch
  Accept-Language: sv-SE,sv;q=0.8,en-US;q=0.6,en;q=0.4,de;q=0.2
  </code></pre>
  
  <p><strong>Is there a way to avoid this extra preflight request?</strong> As far as I see it, the file upload request is a CORS simple request as it is an HTTP POST with Content-Type multipart/form-data and only simple request HTTP headers.</p>
  
  <hr>
  
  <p>The reason why I want to get rid of the extra preflight request is that Cloudinary sends an HTTP 302/304 redirect as a response to the file upload. Browsers do not follow those redirects. Chrome fails with the following message:</p>
  
  <pre><code>XMLHttpRequest cannot load https://api.cloudinary.com/v1_1/wya/image/upload. 
  The request was redirected to 'http://wya.herokuapp.com/upload?bytes=21534&amp;created_at=2014-02-12T09%3A04%3…d5b62ebb92b9236e5be6d472df242d016&amp;type=upload&amp;version=1392195882&amp;width=723', 
  which is disallowed for cross-origin requests that require preflight. 
  </code></pre>