Preflight omits Access-Control-Expose-Headers Debugging Lab

Preflight omits Access-Control-Expose-HeadersAPI & Request FlowMediumPreparing workspaceAutosaved

00:00

Incident Dossier

Preflight omits Access-Control-Expose-Headers

Frontend developers can't read `X-Request-Id` from cross-origin fetches. The headers are clearly present in the network panel but `response.headers.get()` returns `null`. Browser console says nothing about CORS errors, suggesting the preflight is green.

Initial failing signalexpose-headers missing from preflightExpected header present in preflightHeaders() · received header missing

Progress

1Reproduce the bugRun checks

2Edit the fixOpen

3Pass checksOpen

4Submit fixOpen

Reproduction Steps

Run npm test.
Inspect the helper that builds the preflight response.
Find the list of response headers our API ships on real responses.
Make sure the preflight declares them so cross-origin callers can read them.

Focus Mode

Start

src/preflight.js

Likely area

src/preflight.js

Progressive hints

Hints reveal broad direction first, then narrow toward the suspect path without showing hidden tests or exact solution code.

TopicAPI & Request Flow

DifficultyMedium

Est. time14 min

Workspacecreating

Explorer

Preparing workspace files…

Evidence Map

Failing signal loaded from challenge API
Workspace files loaded from workspace API
Results rendered only after API run/submit

Autosaved

workspace

Outputread-onlyready$ workspace boot

Workspace booting...