CORS Preflight Checker — Pasted OPTIONS Response

Inputs

Describe one Fetch request

Request context

Page/request origin Normalized to an origin. Literal null is accepted. Target URL or origin HTTP(S) only; paths are ignored for origin comparison. Request mode Credentials mode Method Known Fetch methods are normalized; custom methods remain case-sensitive.

Author-set request headers One Name: value per line. Browser-controlled headers such as Cookie, Origin, and Host are rejected. Values are required only where they affect safelisting.

Pasted OPTIONS response

HTTP status

Response headers Only the Access-Control-Allow-* fields used by this branch affect the result. A pasted HTTP status line is ignored.

Result

Rule trace

Fill the worksheet, then choose “Explain this preflight”. No request will be sent.

Boundary

What this result does—and does not—mean

Modeled

same-origin versus cross-origin
Fetch request mode and credentials mode
safelisted methods and author headers
OPTIONS status, allowed origin, credentials, method, and header names
credential-mode wildcard rules, including explicit Authorization

Not observed

the real network, redirect chain, browser cache, or final response
service workers, CSP, TLS, client certificates, or Private Network Access
server routing, proxy behavior, or browser-specific diagnostics
whether granting an origin is safe for your application

A PASS is a source-pinned explanation of the pasted facts, not a live browser-equivalence claim and not advice to weaken CORS.

Sources

Rule snapshot

WHATWG Fetch: CORS-preflight fetch, Living Standard last updated 21 Sep 2026; checked 27 Sep 2026.
WHATWG Fetch: CORS-safelisted request headers, including byte/value and 1,024-byte aggregate rules.
WHATWG Fetch: credentials and wildcard combinations.

These links are ordinary navigation only. The worksheet itself makes no network request and loads no third-party asset.