CORS preflight rejected: GET passes but POST does not

• Console reports Response to preflight request doesn't pass access control check, with no Access-Control-Allow-Origin header present.
• OPTIONS /geoserver/rest/process returns 405 Method Not Allowed.
• Only the OPTIONS request appears in the network panel; the real POST never leaves the browser.

1. Filter the network panel by OPTIONS and read the status and headers.
2. Check whether the request really needs credentials or custom headers.
3. Reproduce the preflight with curl, sending Origin, Access-Control-Request-Method and Access-Control-Request-Headers, to rule out browser caching.
4. Check whether the server sends a wildcard origin together with Allow-Credentials true.
5. Confirm the preflight reply carries the headers even on a 4xx status, which needs the always flag.

Answer OPTIONS at the Nginx layer with 204 and Access-Control-Allow-Origin, Allow-Methods GET, POST, PUT, DELETE, OPTIONS, Allow-Headers Content-Type, Authorization, X-Requested-With and Max-Age 86400, all marked always. If credentials are unnecessary, drop credentials include from the fetch so no preflight is sent.

Access to fetch at 'https://gis.example.cn/geoserver/rest/process' from origin
'https://app.example.cn' has been blocked by CORS policy:
Response to preflight request doesn't pass access control check:
No 'Access-Control-Allow-Origin' header is present on the requested resource.

curl -i -X OPTIONS "https://gis.example.cn/geoserver/rest/process" \
  -H "Origin: https://app.example.cn" \
  -H "Access-Control-Request-Method: POST" \
  -H "Access-Control-Request-Headers: content-type,authorization"

• Returning a wildcard Access-Control-Allow-Origin together with Access-Control-Allow-Credentials true, a combination the browser rejects outright.
• Adding the headers only to the 200 response while the 405 preflight reply still blocks the request.