[xg15]

Interesting. Is this still sent as a "safe" request though or does it trigger a preflight request etc?

[Sophira]

If it was one of the requests that would trigger a preflight normally, then yes, it would trigger a preflight. But the code as shown doesn't do that because "multipart/form-data" is one of the allowed MIME types that can bypass these preflights.