CORS Preflight Simulator

Model browser CORS gates from request details and pasted response headers without making a network request.

Educational simulation: this page models a script-initiated CORS-mode fetch and never sends a request. Redirect targets are not followed. Private Network Access (PNA) is an explicit forced-preflight assumption; address-space detection, secure-context and mixed-content gates, permissions, browser rollout, preflight cache caps, client certificates, extensions, service workers, and redirect-tainted origins are outside its scope.

Request

Document origin

Request URL

Method

Content-Type sent

Credentials mode

Preflight cache assumption

Author request headers (one Name: value per line)

Request targets a more-private network and requires PNA preflight

Preflight response

Status code

Response headers

Actual response

Status code

Response headers

Decision

Audit trace

Run the simulation.