CORS policy blocks frontend: pre-release and first 30 minutes checklists

A CORS change blocks the production frontend from calling its own API.

The pre-release checklist maps each item to a test class from the incident page. The first-30-minutes checklist covers detection, containment, the rollback decision and customer communication.

7 pre-release items · 8 first-30-minutes items · verified 2026-10-21

Pre-release checklist

PR-01Run the login end-to-end test in a real browser from every production origin, including each custom domain, and confirm the console shows no CORS error. e2e
PR-02Load the main UI view in a browser against the release candidate and confirm every API call returns an Access-Control-Allow-Origin header for that origin. e2e
PR-03Diff the Access-Control-Allow-Origin, Access-Control-Allow-Headers and Access-Control-Allow-Methods responses of the release candidate against production for each frontend origin. security
PR-04Send a preflight OPTIONS request carrying every header the frontend sends, including tracing headers such as baggage, and confirm each one is listed in Access-Control-Allow-Headers. security
PR-05After upgrading a frontend dependency, list the request headers it adds and confirm the allowed headers policy covers each of them. security
PR-06Run a browser-based synthetic login from each custom domain every few minutes after deploy and alert on the first failure. synthetic
PR-07Make the synthetic login check alert on any 500 response from login URLs. synthetic

First 30 minutes

FM-01Open the application in a browser and read the console for CORS errors on API calls.
FM-02Compare a custom domain with the default subdomain to find which origins fail.
FM-03Send a direct API request; if it succeeds while the browser fails, treat the CORS response headers as the fault.
FM-04Diff the Access-Control response headers against the last good deploy.
FM-05If the headers changed with a backend release, roll that release back before writing a fix.
FM-06If a frontend dependency upgrade added a request header, add that header to the allowed headers policy or pin the previous dependency version.
FM-07Tell affected customers which login URL still works, such as the default subdomain when only custom domains fail.
FM-08Route login error support cases to on-call during out-of-hours until the fix is confirmed.

Download the checklist

Pre-release checklist (Markdown)1.5 KB · v1.0.0
First 30 minutes checklist (Markdown)1.1 KB · v1.0.0

Only in this checklist

Every test class in this checklist also appears in at least one sibling checklist in the group; the item texts differ: Run the login end-to-end test in a real browser from every production origin, including each custom domain, and confirm the console shows no CORS error.

Questions

What should be checked before a release to prevent CORS policy blocks frontend?

7 pre-release items, PR-01 to PR-07. PR-01: Run the login end-to-end test in a real browser from every production origin, including each custom domain, and confirm the console shows no CORS error.

Is there a rollback plan for CORS policy blocks frontend?

The first-30-minutes checklist has 8 items. FM-01: Open the application in a browser and read the console for CORS errors on API calls.

What should a team do in the first 30 minutes after CORS policy blocks frontend is detected?

The first-30-minutes checklist has 8 items. FM-01: Open the application in a browser and read the console for CORS errors on API calls.

Is a CORS policy blocks frontend checklist still needed if deployment is automated?

Yes. Automation runs the steps; the checklist names what the tests must cover: end-to-end tests, security tests and synthetic monitoring.

Which pipeline stages does the CORS policy blocks frontend checklist cover?

The pre-release items map to the pre-deploy and post-deploy stages.

In what formats can the CORS policy blocks frontend checklist be downloaded?

Both checklists download as Markdown files: /downloads/cors-policy-blocks-frontend-pre-release.md and /downloads/cors-policy-blocks-frontend-first-30-minutes.md, licensed CC BY 4.0.