CORS Decision Flow

A live flowchart of how the browser decides whether your JavaScript may read a response. HTML nodes are positioned over a canvas that draws the bezier edges; the active path lights up as you change the request and server configuration. Watch where a request ends up: READ, BLOCKED, or OPAQUE.

Request

Same-origin request fetch mode Method

Request shape

Content-Type custom header (e.g. Authorization) credentials: "include"

Server response

Access-Control-Allow-Origin Allow-Credentials: true Preflight approved (Methods/Headers)

active path inactive blocked opaque