CORS Preflight Explainer

Paste the OPTIONS request and the response headers of a CORS preflight and walk every rule the browser applies, in order, each with a pass or fail and the reason - including the wildcard origin with credentials that is invalid no matter what else the response says.

Network & webCorsPreflightAccess ControlHeaders
CORS Preflight Explainer screenshot

Paste the OPTIONS request and the response headers of a CORS preflight and get every rule the browser applies, in order, each with a pass or fail and the reason. Covers the wildcard-origin-with-credentials case that is invalid no matter what else the response says, wildcard headers, the explicit credential opt-in, and the private-network preflight. RULE BY RULE WILDCARD TRAP PREFLIGHT

Rules, in the order the browser applies them

More tools