"Simple requests" are not preflighted, such as those that do not set any headers (among other qualifications).

https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simpl...

(Aside, is MDN's href linking broken for everyone or just me?)

"Simple" requests are sent without a OPTIONS preflight check. It's because old style forms could always do a cross-origin request, so you have to protect against it anyway.

For the full definition of what is a "simple" request: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simpl...

EDIT: Lol @ jakear making an almost identical response with the same Mozilla link.

There are plenty of browser implementations in things like SmartTVs that don’t implement CORS and other security related features correctly.

First of all, you could probably do a timing attack on CORS response, you'd just have to deal with how much they're cached.

Depends on the resource request. For example, <img> can be used to load remote resources without CORS, since the image data isn't shared with JS (trying to read it via a canvas marks it "tainted", and errors read requests). Meltdown/Spectre breaks this barrier down, which led to the introduction of COOP/COEP headers that require CORS on remote requests and would break this attack—except that you can ask the browser to send requests without cookies, re-introducing this timing attack.