Incident Dossier

Preflight omits Access-Control-Expose-Headers

Frontend developers can't read `X-Request-Id` from cross-origin fetches. The headers are clearly present in the network panel but `response.headers.get()` returns `null`. Browser console says nothing about CORS errors, suggesting the preflight is green.

Initial failing signalexpose-headers missing from preflightExpected behavior: preflightHeaders() declares the response header exposed to browser scripts. · actual behavior: preflightHeaders() omits the response header exposed to browser scripts.

Progress

1Reproduce the bugRun checks

2Edit the fixOpen

3Pass checksOpen

4Submit fixOpen

Reproduction Steps

Run npm test.
Inspect the helper that builds the preflight response.
Find the list of response headers our API ships on real responses.
Make sure the preflight declares them so cross-origin callers can read them.

Focus Mode

Start

src/preflight.js

Likely area

src/preflight.js

Challenge Coach

Hints reveal broad direction first, then narrow toward the suspect path without showing hidden tests or exact solution code.

TopicAPI & Request Flow

DifficultyMedium

Est. time14 min

Workspacepreparing

Explorer

Loading files

Evidence Map

Failing signal loaded from challenge API
Workspace files loaded from workspace API
Results rendered only after API run/submit

Autosaved

workspace

Outputread-onlyready$ prepare workspace

Preparing workspace