The server answers with Access-Control-Allow-* headers; Access-Control-Max-Age lets the browser cache the answer.
Preflight request
An OPTIONS request a browser sends first to ask whether a cross-origin request with a custom method or header is allowed.