Trace CORS from preflight to readable response

Find which response fails, grant only trusted origins and distinguish CORS from cookie or transport failures.

Start in the browser network panel

Record the page origin and target URL. If OPTIONS appears, inspect its status and requested method/headers. If no HTTP response exists, investigate DNS, TLS, mixed content or CSP first. curl and Node can inspect headers, but they do not demonstrate browser CORS enforcement.

Use an explicit origin policy

Compare the complete serialized origin, including scheme and non-default port, against trusted values. Never reflect arbitrary callers with credentials. Send a single matching origin and merge Origin into Vary so a shared cache does not reuse one caller's grant for another.

const allowed = new Set(['https://app.example']);
function originHeaders(origin) {
  if (!allowed.has(origin)) return {};
  return {
    'Access-Control-Allow-Origin': origin,
    'Access-Control-Allow-Credentials': 'true',
    'Vary': 'Origin'
  };
}

Approve only the intended preflight

For a JSON POST with Authorization, the permitted OPTIONS response needs a successful status, the origin grant, POST in Allow-Methods and Content-Type plus Authorization in Allow-Headers. OPTIONS normally arrives without the session cookie, so evaluate policy before endpoint authentication. Authenticate the real POST. Reject unsupported methods and headers rather than echoing them all.

Check the actual response too

The POST response still needs the origin and credential grants, including on 401/422 errors. To read X-Request-Id, list it in Expose-Headers. Allow-Headers cannot expose response headers. Set-Cookie remains unavailable to JavaScript even when listed. Check proxy-generated errors separately because application middleware never sees them.

Separate session and caching problems

credentials: include does not override SameSite or third-party cookie restrictions. If cross-site cookies are essential, check SameSite=None; Secure and CSRF protection, then inspect browser exclusion reasons. Use a fresh browser context while debugging cached preflights. Finish with allowed and denied origins, authenticated and anonymous requests, and success and error responses in the actual supported browsers.

Verification scope

Authored browser troubleshooting cases. Offline policy fixtures check selected header/configuration behavior; no browser, proxy, cookies, canvas, CSP or live origin has been certified.