Allow the Request

Allow Origin

The response allows the exact asking origin.

highlighted = computed this step

The response names the same origin

The allow-origin row matches the Origin row from the preflight request.

origin match=yes\text{origin match}=\text{yes}
Allow originThe CORS allow headers and empty response body are recomputed from pinned bytes.Allow origin - OPTIONS /api asks for POST; response 204 No Content allows itsectionnamevaluecheckrequest linemethodOPTIONSpreflightrequest linepath/apiparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderOriginhttps://app.exampleaskedheaderAccess-Control-Request-MethodPOSTaskedbodybyte length0emptystatusversionHTTP/1.1parsedstatusstatus204 No Contentno contentheaderAccess-Control-Allow-Originhttps://app.exampleallows originheaderAccess-Control-Allow-MethodsPOSTallows methodheaderContent-Length0empty bodybodybyte length0countedcheckorigin matches allow-originyesallowedcheckrequested method is allowedyesallowedcheckstatus204 No Contentno contentchecksent body bytes0empty

The response says No Content

The status row says the response is an empty permission answer.

204 No Content204\ \text{No Content}
Allow originThe CORS allow headers and empty response body are recomputed from pinned bytes.Allow origin - OPTIONS /api asks for POST; response 204 No Content allows itsectionnamevaluecheckrequest linemethodOPTIONSpreflightrequest linepath/apiparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderOriginhttps://app.exampleaskedheaderAccess-Control-Request-MethodPOSTaskedbodybyte length0emptystatusversionHTTP/1.1parsedstatusstatus204 No Contentno contentheaderAccess-Control-Allow-Originhttps://app.exampleallows originheaderAccess-Control-Allow-MethodsPOSTallows methodheaderContent-Length0empty bodybodybyte length0countedcheckorigin matches allow-originyesallowedcheckrequested method is allowedyesallowedcheckstatus204 No Contentno contentchecksent body bytes0empty

Content-Length says no body bytes

The response Content-Length is 0, matching the empty response body.

sent body bytes=0\text{sent body bytes}=0
Allow originThe CORS allow headers and empty response body are recomputed from pinned bytes.Allow origin - OPTIONS /api asks for POST; response 204 No Content allows itsectionnamevaluecheckrequest linemethodOPTIONSpreflightrequest linepath/apiparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderOriginhttps://app.exampleaskedheaderAccess-Control-Request-MethodPOSTaskedbodybyte length0emptystatusversionHTTP/1.1parsedstatusstatus204 No Contentno contentheaderAccess-Control-Allow-Originhttps://app.exampleallows originheaderAccess-Control-Allow-MethodsPOSTallows methodheaderContent-Length0empty bodybodybyte length0countedcheckorigin matches allow-originyesallowedcheckrequested method is allowedyesallowedcheckstatus204 No Contentno contentchecksent body bytes0empty

Summary

The origin check passes because the answer names the same origin.

allow-origin checked\text{allow-origin checked}
Allow originThe CORS allow headers and empty response body are recomputed from pinned bytes.Allow origin - OPTIONS /api asks for POST; response 204 No Content allows itsectionnamevaluecheckrequest linemethodOPTIONSpreflightrequest linepath/apiparsedrequest lineversionHTTP/1.1parsedheaderHostapi.exampleexactheaderOriginhttps://app.exampleaskedheaderAccess-Control-Request-MethodPOSTaskedbodybyte length0emptystatusversionHTTP/1.1parsedstatusstatus204 No Contentno contentheaderAccess-Control-Allow-Originhttps://app.exampleallows originheaderAccess-Control-Allow-MethodsPOSTallows methodheaderContent-Length0empty bodybodybyte length0countedcheckorigin matches allow-originyesallowedcheckrequested method is allowedyesallowedcheckstatus204 No Contentno contentchecksent body bytes0empty