CORS checker

The browser says "blocked by CORS policy" and shows you nothing. This sends the same preflight and shows you everything.

We send an OPTIONS preflight and a plain GET, and read the headers that come back.

What the browser is actually checking

Access-Control-Allow-Origin: Must be * or your exact origin — scheme, host and port. https://app.example.com and https://app.example.com:443 are the same; http:// and https:// are not.
The preflight itself: Anything beyond a simple GET/POST makes the browser send OPTIONS first. If that answers 401, 404 or 500 — a common outcome when auth middleware runs before the CORS one — nothing else matters.
Allow-Methods and Allow-Headers: The method and every non-simple header you send (Authorization, Content-Type: application/json) must be listed.
Credentials: Allow-Credentials: true cannot be combined with Allow-Origin: *. Browsers refuse that pair outright.

Note: CORS is enforced by browsers, not by servers. A request that works in curl or Postman and fails in the page is almost always this.

Monitor this endpoint for free — including endpoints that refuse a plain GET.