2026-09-07 · 6 min read · Rahul Chitturi
- cors
- http
- debugging
A browser can block an API call before sending the application request when its CORS preflight fails. The OPTIONS exchange asks whether one origin may use a method, headers, and credentials against another origin.
A successful curl request does not reproduce this browser security decision, and a cached preflight can make two developers see different results against the same deployment.
Capture the browser exchange
Record the page origin, target URL, OPTIONS request headers, response status, CORS response headers, redirect chain, and following request. Use the browser network panel because JavaScript often receives only a generic fetch failure.
- Match the Origin value exactly against the intended allowlist
- Confirm the requested method and every non-safelisted header
- Return CORS headers on errors as well as successful preflights
- Check which proxy or application answers OPTIONS
Treat credentials and caching explicitly
Credentialed requests need an explicit allowed origin and the credentials response header; a wildcard origin is not a compatible shortcut. Add Vary: Origin when the response changes by request origin so shared caches do not reuse the wrong policy.
Access-Control-Max-Age can reduce preflight traffic, but browsers cap it and cache entries by request details. Keep the lifetime short enough to roll policy changes out predictably.
A Flashman workflow
Use the URL tool to compare origins and redirects, JSON formatter for sanitized gateway logs, diff for response headers, timestamp converter for cache timelines, and case converter to expose header-name drift in configuration.
Test allowed and denied origins, methods, custom headers, credentials, redirects, cached policy changes, error responses, CDN behavior, and each supported browser.