title: In CORS, Are POST request with credentials pre-flighted ?
body: <p>In <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS#Requests_with_credentials" rel="nofollow">MDN Access Cotrol doc</a>, GET request with credentials are not preflighted. But if response headers doesn't include Access-Control-Allow-Credentials: true then response will not be available to the invoking client. If this behaviour same for POST (Simple POST request with credentials - Content Type may be form-data) request as well, there is risk that POST might change the server state though response may not be made available to client. Is this assumption correct?</p>
  
  <p>OR POST request with credentials pre-flighted?</p>