Debug a CORS Preflight Failure

Scenario

The browser console shows a CORS error — something like "No 'Access-Control-Allow-Origin' header is present" — but the network tab in devtools doesn't make it obvious which response header is missing or misconfigured. You need to see the actual preflight request and response the browser sent and received.

Steps

Start the proxy:

laurel-proxy start

If the target API uses HTTPS, trust the CA certificate so Laurel Proxy can decrypt the traffic:

laurel-proxy trust-ca

Reproduce the failing request in your browser (with the proxy configured as your system proxy), then query for the preflight:

laurel-proxy requests --method OPTIONS --host api.example.com --format agent

The --method OPTIONS flag filters to only preflight requests. The --format agentoutput includes the full response headers, so you can read the Access-Control-* values directly instead of reconstructing them from devtools.

Example output:

{
  "summary": "OPTIONS https://api.example.com/v1/users → 204 (took 12ms)",
  "request": {
    "method": "OPTIONS",
    "headers": {
      "origin": "http://localhost:5173",
      "access-control-request-method": "POST",
      "access-control-request-headers": "content-type,authorization"
    }
  },
  "response": {
    "status": 204,
    "headers": {
      "access-control-allow-origin": "https://app.example.com",
      "access-control-allow-methods": "GET,POST",
      "access-control-allow-headers": "content-type"
    }
  }
}

Compare the request headers against the response headers. Common mismatches:

  • Access-Control-Allow-Origin doesn't match the Origin the browser sent (as above — localhost:5173 vs. the allowed app.example.com)
  • Access-Control-Allow-Headers is missing a header the request sends, such as authorization
  • Access-Control-Allow-Methods doesn't include the method the actual request will use
  • The preflight itself returns a non-2xx status, so the browser never sends the real request

With Your AI Agent

With the AI Agent Plugin, describe the CORS error and let your agent trace it:

You: "Requests to api.example.com are failing with a CORS error. Debug it."

Your agent queries: laurel-proxy requests --method OPTIONS --host api.example.com --format agent
The agent compares the Origin header on the request against the
Access-Control-Allow-Origin on the response, spots the mismatch, and
updates your server's CORS configuration.

Your agent sees both sides of the preflight handshake in one query, instead of you manually diffing headers in devtools.

← Trace 422 ErrorsFind Slow Endpoints →