A portal can show a browser error after a request reached its server. Repeating the action without checking can duplicate work. For an integration handover, separate whether the browser may read a response, whether credentials were included and whether the business operation occurred.
Source-bound fact
Credentialed CORS responses cannot use a wildcard allowed origin. CORS response access is not server authorisation. Official reference · Checked 17 October 2026.
Filled synthetic acceptance example
Synthetic teaching example, not a client case or a real-platform assessment. On narrow screens, scroll to read the complete table.
| Input | Check basis | Expected |
|---|---|---|
| Originhttps://portal.example; credentialsinclude; allow* | invalid credentialed read contract | browser access not approved |
| Exact origin; credential flagtrue | necessary header conditions | candidate; test preflight and auth |
| CORS error after submit | backend result unknown | reconcile operationID before retry |
Supplier acceptance procedure
- Record requesting origin, credential mode, actual response headers and any preflight result.
- Ask for an authorised test with an allowed and a denied origin; never fix it by granting every site credentials.
- Compare the operation reference with server records before allowing a second submission.
Interpret the output
The checker flags one incomplete header contract and identifies a candidate, not a permission grant. A readable response still needs authentication and object ownership. Cookie blocking, redirects and preflight can fail independently and need their own evidence.
Explicit limits
No live cross-origin requests, proxy bypass, cookie changes or production security changes. Embedded-login storage and access-control tests remain separate.
Replay the finite teaching model
Save both files in one folder and use Node22 or newer. JSON contains inputs and expected results. The script processes synthetic data only, with no network, credentials, payment or paid API calls. Passing is not evidence that a real integration passed acceptance.
Filled inputs and expectations · Inspectable teaching script
node check.mjs portal-cors-credential-read-contract.json