cors-test-lab/README.md

CORS Test Lab

A static, browser-based dashboard for testing real CORS behavior from the page origin. It is built for GitHub Pages and does not need a backend, proxy, database, API key, or server runtime.

Features

• Request builder with URL, method, mode, credentials, timeout, headers, content type, and body.
• One-click probes for simple GET, JSON POST, credentials, custom headers, DELETE, and no-cors.
• Preflight detection based on method, headers, and content type.
• Result view with status, timing, visible response headers, readable body preview, and browser error classification.
• CORS diagnostics for failed preflights, missing readable responses, credentialed CORS pitfalls, mixed content, and opaque no-cors behavior.
• Domain policy notes for expected allowed and blocked origins, included in saved cases and copied reports.
• Saved test cases in localStorage, with JSON import/export.
• Copyable diagnostic report for API teams.

Important Browser Limits

This app tests CORS exactly as a browser enforces it. It cannot bypass CORS.

• If the browser blocks a CORS response, JavaScript cannot read the blocked response headers or body.
• Browser-managed headers such as Origin, Host, Cookie, Referer, and Sec-* cannot be manually set.
• no-cors requests can produce opaque responses where status, headers, and body are intentionally hidden.
• Testing from GitHub Pages means your API sees the app origin as https://<user>.github.io.
• To verify that an API allows domain A but blocks domain B, run the test page from domain A and domain B. The domain policy fields document expected behavior, but they do not spoof origins.

Local Development

npm ci
npm run dev

Build for production:

npm run build

Preview the production build:

npm run preview

Publish to GitHub Pages

1. Push this repository to GitHub.
2. In the GitHub repository, open Settings > Pages.
3. Set Build and deployment > Source to GitHub Actions.
4. Push to the main branch, or run the Deploy to GitHub Pages workflow manually.

The workflow builds the static app with Vite and deploys the dist artifact to GitHub Pages.

License

MIT