My API is configured to cache CORS preflight request by using the HTTP header Access-Control-Max-Age. The value is set to 600 seconds. I chose this value because according to Mozilla documentation this is the maximum allowed by Chrome.
Maximum number of seconds the results can be cached. Firefox caps this at 24 hours (86400 seconds) and Chromium at 10 minutes (600 seconds). Chromium also specifies a default value of 5 seconds. A value of -1 will disable caching, requiring a preflight OPTIONS check for all calls.
What is a recommended Access-Control-Max-Age value and how to choose it?