CORS — Interactive Request Inspector

1 · Request Inspector — Simple or Preflight?

Configure a cross-origin fetch and see whether the browser sends it directly (simple) or fires an OPTIONS preflight first — plus exactly why, and the response headers the server must return.

Method

Content-Type

Custom headers (comma-sep)

credentials: "include" (send cookies)

Generated request (fetch)

Preflight the browser sends first

Response headers the server must return

2 · What Bypasses CORS Read-Checks?

CORS blocks reading a response in JS — not sending the request. These cross-origin mechanisms send requests freely; only some let your script read the result.