CORS, Cookies, and Headers

End-to-end developer runbook

1. Step 1 - Confirm the API area: Identify the product area, route module, endpoint path, and consumer before writing or calling code.
2. Step 2 - Read the endpoint contract: Check method, auth, parameters, response, errors, side effects, and related docs.
3. Step 3 - Prepare authentication and input: Use the right session, bearer token, webhook secret, or internal header. Validate body and query data before sending it.
4. Step 4 - Make the request: Call the endpoint from the correct origin and environment. Keep credentials and secrets out of logs.
5. Step 5 - Verify response, side effects, and records: Confirm status code, response shape, database records, external side effects, and audit evidence.
6. Step 6 - Add tests, docs, and handoff notes: Update route inventory, consumer notes, and certification checks before depending on the change.

Worker CORS behavior

1. Action 1 - Origin selection: ALLOWED_ORIGIN may contain comma-separated origins. The Worker chooses the request origin when it is allowed, otherwise the first configured origin.
2. Action 2 - Local allowances: Local request URLs add http://127.0.0.1:4321, http://localhost:4321, http://127.0.0.1:4322, and http://localhost:4322.
3. Action 3 - Allowed headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id.
4. Action 4 - Allowed methods: GET, POST, PUT, PATCH, DELETE, and OPTIONS.
5. Action 5 - Credentials: CORS is configured with credentials enabled.

Security headers

Header	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
Referrer-Policy	strict-origin-when-cross-origin
X-XSS-Protection	0