1 楼已经揭秘，

Some requests don't trigger a CORS preflight. Those are called simple requests from the obsolete CORS spec, though the Fetch spec (which now defines CORS) doesn't use that term.

简单请求，它只是不触发预检，服务端收到请求做了应答，浏览器根据响应头做 CORS 校验。
HTTP/2 200
accept-ranges: bytes
content-encoding: br
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-length: 7450
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 11 Jul 2024 10:40:23 GMT
expires: Fri, 11 Jul 2025 10:40:23 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 08 Jul 2024 09:30:00 GMT
content-type: text/javascript
vary: Accept-Encoding
age: 483284
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2


不做预检，服务端能收到业务请求
做预检，服务端收不到业务请求