Noindex support page
Method and source version
The engine implements a bounded trace of the WHATWG Fetch CORS-preflight branch: origin comparison, request-mode applicability, preflight triggers, OK status, the CORS origin/credentials check, and allowed method/header matching.
It uses the Fetch Living Standard last updated 21 September 2026, checked 1 October 2026. Header input represents developer/author-set request headers after ordinary field-value normalization; browser-controlled request headers are rejected.
Deliberate limits
- No network or browser engine is invoked.
- No preflight cache, redirect, final response, Private Network Access, service worker, CSP, TLS, or browser console wording is modeled.
- The result is not a security recommendation and does not decide whether an origin should be trusted.