Blog
Heroku dynos: sleep, cold starts, and why CORS preflight latency spikes on free tiers
First request after idle may wake the dyno; browsers see slow OPTIONS before the main API call proceeds.
1 min read
herokupaascors
Routing mesh
Heroku’s router terminates TLS; ensure your app returns CORS headers for both HTTP/1.1 and HTTP/2 clients.
Review HSTS headers when custom domains point through SSL endpoints.
Add-ons
Postgres and Redis add-ons do not fix CORS—your web process still owns headers.
Log drain to external SIEM for correlation across dyno restarts.