🎮 CORS request simulator

You're https://app.example.com, calling an API on a different origin. Pick a request shape, a credentials setting, and the server's CORS config — then send it and watch exactly what the browser does step by step.

1 Request shape

A safelisted content type is sent directly. application/json is not on the safelist, so the browser asks permission first with an OPTIONS preflight.

Requires the server to allow credentials explicitly — and to name your exact origin, never a wildcard.

2 Server's CORS configuration
3 Send it
app.example.com → preflight? → server → your JS
Ready — pick a config and send.