Browsers send preflight requests (OPTIONS requests) to check if the server allows the actual request. The cors middleware handles this for you, but if you need more control, you can set up custom handling:
app.options('*', cors(corsOptions)); // Pre-flight requests
Handling Preflight Requests