The toy CORS example keeps its boundary narrow.
What this toy model checks
The trust boundary parses one OPTIONS request, one allow response, the Origin row, the requested method row, and the empty body check.
recompute CORS preflight \text{recompute CORS preflight} recompute CORS preflight CORS honesty boundary The CORS allow headers and empty response body are recomputed from pinned bytes. CORS honesty boundary - OPTIONS /api asks for POST; response 204 No Content allows it section name value check request line method OPTIONS preflight request line path /api parsed request line version HTTP/1.1 parsed header Host api.example exact header Origin https://app.example asked header Access-Control-Request-Method POST asked body byte length 0 empty status version HTTP/1.1 parsed status status 204 No Content no content header Access-Control-Allow-Origin https://app.example allows origin header Access-Control-Allow-Methods POST allows method header Content-Length 0 empty body body byte length 0 counted check origin matches allow-origin yes allowed check requested method is allowed yes allowed check status 204 No Content no content check sent body bytes 0 empty
Honesty boundary
NOTE: toy CORS preflight only; not browser enforcement internals, credentials, cookies, wildcard origins, header lists, max-age caching, redirects, failed preflights, private network access, proxies, HTTP/2 or HTTP/3, frameworks, or production server config.
toy CORS preflight only \text{toy CORS preflight only} toy CORS preflight only CORS honesty boundary The CORS allow headers and empty response body are recomputed from pinned bytes. CORS honesty boundary - OPTIONS /api asks for POST; response 204 No Content allows it section name value check request line method OPTIONS preflight request line path /api parsed request line version HTTP/1.1 parsed header Host api.example exact header Origin https://app.example asked header Access-Control-Request-Method POST asked body byte length 0 empty status version HTTP/1.1 parsed status status 204 No Content no content header Access-Control-Allow-Origin https://app.example allows origin header Access-Control-Allow-Methods POST allows method header Content-Length 0 empty body body byte length 0 counted check origin matches allow-origin yes allowed check requested method is allowed yes allowed check status 204 No Content no content check sent body bytes 0 empty
No client compute
The page shows already validated rows. It does not run browser CORS logic.
static validated rows \text{static validated rows} static validated rows CORS honesty boundary The CORS allow headers and empty response body are recomputed from pinned bytes. CORS honesty boundary - OPTIONS /api asks for POST; response 204 No Content allows it section name value check request line method OPTIONS preflight request line path /api parsed request line version HTTP/1.1 parsed header Host api.example exact header Origin https://app.example asked header Access-Control-Request-Method POST asked body byte length 0 empty status version HTTP/1.1 parsed status status 204 No Content no content header Access-Control-Allow-Origin https://app.example allows origin header Access-Control-Allow-Methods POST allows method header Content-Length 0 empty body body byte length 0 counted check origin matches allow-origin yes allowed check requested method is allowed yes allowed check status 204 No Content no content check sent body bytes 0 empty
Summary
A CORS preflight asks first, and this toy answer allows the origin and method with no body.
preflight answer checked \text{preflight answer checked} preflight answer checked CORS honesty boundary The CORS allow headers and empty response body are recomputed from pinned bytes. CORS honesty boundary - OPTIONS /api asks for POST; response 204 No Content allows it section name value check request line method OPTIONS preflight request line path /api parsed request line version HTTP/1.1 parsed header Host api.example exact header Origin https://app.example asked header Access-Control-Request-Method POST asked body byte length 0 empty status version HTTP/1.1 parsed status status 204 No Content no content header Access-Control-Allow-Origin https://app.example allows origin header Access-Control-Allow-Methods POST allows method header Content-Length 0 empty body body byte length 0 counted check origin matches allow-origin yes allowed check requested method is allowed yes allowed check status 204 No Content no content check sent body bytes 0 empty