CORS Decision Lab

Switch between request shapes and policy outcomes to see when the browser sends the request, preflights it, or exposes the response.

scenario

Blocked simple read

main lesson

No CORS headers

Caller: https://shop.milan.example issues GET https://api.berlin.example/customers

origin boundary

Caller and target

Cross-origin GET, no custom headers, no credentials

The request can still happen even though the browser refuses to hand the answer to the page.

browser classification

Request shape

Simple request. No preflight. Browser sends the GET directly.

Credentials: No ambient credentials are involved here, so the main question is response readability.

network phase

Preflight or direct send

None. This request stays in the simple bucket because the method and headers are safelisted.

server and cache

Header decision

API returns `200 OK` with JSON but sends no `Access-Control-Allow-Origin` header.

script visibility

Browser outcome

Server logs show a normal request. JavaScript gets a CORS failure and cannot read the JSON body.

cache note

What caching changes here

No preflight cache is involved. Shared caches can still store the body, but script access remains blocked without CORS.

Step 1 / 5A script on one origin targets another

CORS only matters because the caller and the target are on different origins. The browser starts by comparing scheme, host, and port.

Scenario focus: No CORS headers

Arrow keys to navigate · R to reset

Tap dots to jump to any step