CROSS-ORIGIN RESOURCE SHARING & PREFLIGHT SANDBOX

CORS Policy & Preflight Diagnostic Sandbox

Interactive CORS workbench to validate HTTP request/response headers, diagnose wildcard credential violations, check Vary: Origin caching safety, and simulate preflight OPTIONS.

1. Cross-Origin Request

Origin (Request Header)

HTTP Method

Request Headers

withCredentials (Cookies & Authorization headers)

2. Server Response Headers

Response Headers (Key: Value)

Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Credentials: true
Vary: Origin

Policy & Security Diagnostics

Preflight OPTIONS Succeeded

Preflight handshake conforms to W3C Fetch specification.

Browser Max-Age Ceilings

Web browsers enforce hard maximum limits on Access-Control-Max-Age caching for preflight OPTIONS responses to prevent stale permission pinning.

Browser Engine	Max-Age Ceiling	Effective Duration
Chromium (Chrome, Edge, Brave)	`7,200s`	2 hours max
Apple Safari (WebKit)	`600s`	10 minutes max
Mozilla Firefox (Gecko)	`86,400s`	24 hours max