#cors 10 articles

• Retry-After does not survive CORS — a header you send and the client reads can still arrive as nullgotchas / azure-functionsA cross-origin response exposes only the headers named in Access-Control-Expose-Headers plus a short safelist, so an API that sends Retry-After and a client that reads it still meet at null — both ends look right and a…
• A server-side origin check rejects your own smoke test — and the runbook that says "this bypasses CORS"gotchas / azure-functionsOnce the allowlist is enforced in the handler it applies to every caller, so the deploy script's own verification and the runbook command both need the Origin header; "this test bypasses CORS" stops being true and…
• An SPFx web part that calls an intranet API makes Chrome and Edge ask every user for local network accessgotchas / spfxA *.sharepoint.com page fetching a host that resolves to a private IP is a local network request – Chrome (from 142) and Edge prompt every user and a refusal is a bare Failed to fetch; pre-allow the SharePoint origin…
• Exchange Online Admin API (the REST behind EXO V3) cannot be called from the browser — no CORS, and SPFx tokens lack Exchange.Managegotchas / graphadminapi/beta/{tenant}/InvokeCommand fails with 'Failed to fetch' even with a fake token; read Exchange config with an admin-run script and import, or use Graph message trace and mailbox reports
• Getting bulk data into a SharePoint page from the console — a localhost server beats pasting, and beats uploading it somewheregotchas / toolingServe the payload from 127.0.0.1 with CORS instead of pasting it or uploading it; loopback is a trustworthy origin so HTTPS pages may fetch it – and when Chrome local network access blocks it ("Failed to fetch"), feed…
• Graph usage reports in the browser — the v1.0 CSV redirect is CORS-blocked, beta JSON worksgotchas / graphv1.0 302 to CSV dies on CORS; beta ?$format=application/json returns 200 from Graph; mind roles and concealed names
• Moving a static CDN off GitHub Pages without breaking the apps that load from itgotchas / toolingUpload git blobs, not a Windows working tree (CRLF breaks SRI); allow the new CA in CAA; missing files must stay 404, not 403; Azure static website has no CORS and Front Door ignores the query string by default…
• SP.WebProxy is add-in-only — from SPFx it 403s with "without an app context"gotchas / spfxNo SharePoint-native CORS proxy for SPFx; the 403 hides inside an HTTP 200
• The public Microsoft 365 roadmap JSON has no CORS headers — an SPFx web part can't fetch itgotchas / spfxreleasecommunications/api/v1/m365 answers 200 without Access-Control-Allow-Origin; proxy it server-side
• Verifying CORS by header presence passes every origin — compare the value to the Origin you sentgotchas / azure-functionsThe header comes back for every origin (servers answer with a fallback, not an omission), so presence proves nothing; compare it to the Origin you sent, keep at least one case that expects allowed, and point the probe…