Border

Use when the user hits a CORS error ("blocked by CORS policy", "No 'Access-Control-Allow-Origin' header", "preflight", "Failed to fetch" from a frontend) or is about to call a public API from browser code (React, Next.js, Vue, a browser extension page) and asks whether it will work (signals: "CORS", "works in Postman but not in the browser", "preflight 401/404", "Access-Control-Allow-Headers", "withCredentials", "credentials include"). Sends the browser's own preflight (OPTIONS with Origin, Access-Control-Request-Method and -Headers) to the live API and, for GET and HEAD, the request itself with the Origin header, then applies the Fetch standard CORS rules as Chrome implements them. Returns verdict (allowed, blocked, preflight_passed, incomplete, same_origin, unreachable), the exact Chrome console error, which step fails (preflight or response) and why, whether a preflight is needed and why, the CORS headers the server sent, warnings (missing Vary: Origin, a server that echoes any origin with credentials, unreadable response headers, Authorization covered only by *), the exact response headers that fix it, and curl commands to reproduce. Example: {"url":"https://api.example.com/v1/items","origin":"http://localhost:3000","method":"POST","headers":["Content-Type: application/json","Authorization"],"credentials":true}. Limits: public http/https APIs on ports 80 and 443 only (localhost, private and staging servers go through border_check_cors_headers with pasted curl output); never sends POST, PUT, PATCH or DELETE (those get the preflight checked only) and never sends header values for Authorization or keys; a server can answer differently to a real browser session.

Use when a CORS problem involves a server Border cannot reach (localhost, a dev or staging server, a private network, a custom port) or a POST, PUT, PATCH or DELETE whose real response needs checking, and the raw response headers are available from curl -i or the browser DevTools Network tab (signals: "here is the OPTIONS response", "my local API returns these headers", "CORS works on localhost but not in production", "preflight response is"). Parses the pasted OPTIONS response and/or the actual response (status line plus headers; curl -i, curl -v, curl -iL with redirects, and DevTools copies are all read) and applies the Fetch standard CORS rules as Chrome implements them, for the given page origin, method, request headers and credentials mode. Returns the same result as border_check_cors: verdict, the exact Chrome console error, the failing step and reason, warnings, the response headers that fix it, and the curl commands to capture any missing response. Nothing is fetched. Example: {"url":"http://localhost:8000/api/login","origin":"http://localhost:5173","method":"POST","headers":["Content-Type: application/json"],"credentials":true,"preflight_response":"HTTP/1.1 200 OK\nAccess-Control-Allow-Origin: *\nAccess-Control-Allow-Headers: content-type"}. Limits: the verdict is only as complete as the pasted headers; a preflighted request needs both pastes for a full answer.