Super slow preflight OPTIONS in Chrome only

Question

I\'ve been struggling recently with a super-weird problem only happening in Chrome: as my API (NodeJS) is on a different subdomain, I need to use CORS to reach it from my front-

Answer 1

I've been seeking to debug this and it appears to be a chrome bug as we were experiencing the same issue.

For reference, I've filed a bug report to chromium here: CORS pre-flight and subsequent requests are very slow only on Chrome

I'm adding this here to help stop any more developers spending half a day investigating it ;) Will update as we here more from Chromium.

Overview of bug report follows:

UserAgent:

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36

Steps to reproduce the problem:

1. Have app.domain.com
2. List item
3. Have api.domain.com
4. Enable CORS on API to enable access
5. Check responses in DevTools, see OPTIONS and GET requests are taking up to 300ms+

What is the expected behavior?

Response timings should be accurate.

What went wrong?

We are using Go microservices and noticed a big disparity in the time taken between browsers - chrome being the slowest up to a magnitude of 100x.

when we have checked the timings from the backend, responses take at most 10ms, with most being sub 1ms. When checking the timing under devtools the same responses were coming in at ~100ms~1s.

Did this work before?

N/A

Chrome version: 63.0.3239.132 Channel: stable OS Version: 10.0 Flash Version:

In Firefox (and any other browser), the exact same requests return in ~1-20ms as expected.

In trying to diagnose further, we used Telerik's Fiddler to check the actual network response times and confirmed that they were being sent and received by Chrome within our expected timings. The only conclusion we could come to is that something internal to Chrome is slowing the processing of these requests down.

We tried all permutations of chrome://flags#out-of-blink-cors and chrome://flags#enable-site-per-process, which are the two options which we spotted which seem vaguely relevant. Nothing seemed to help.

We have also found many Stack Overflow articles about a similar issues that make mention of it being a Chrome bug, but I haven't been able to find it reported here:

• Super slow preflight OPTIONS in Chrome only
• https://github.com/corydolphin/flask-cors/issues/147
• Slow cors preflight OPTIONS Request in Chrome

We've just tested Chrome on MacOS and it doesn't appear to be an issue - so may be limited to Windows.

Chrome:

Edge:

Firefox: