I learned
There are two types of CORS request,

1.Simple request
If the request is allowed then server respond with header that includes Access-Control-Allow-Origin: * or requested origin

1. Preflight Request:

Request sent before the original request by browser.

It will get triggered when
1.The HTTP method is PUT, DELETE and PATCH.

1. Request header includes Authorization & X-Custom-Header
2. Request has content type other than application/x-www-form-urlencoded, multipart/form-data, or text/plain