# CORS policy blocks frontend: pre-release checklist

Source: https://releasefailures.com/incidents/cors-policy-blocks-frontend/
Content version: 1.0.0
Verified on: 2026-10-21
Licence: CC BY 4.0

Definition: A CORS change blocks the production frontend from calling its own API.
- [ ] PR-01 Run the login end-to-end test in a real browser from every production origin, including each custom domain, and confirm the console shows no CORS error. (test class: End-to-end tests)
- [ ] PR-02 Load the main UI view in a browser against the release candidate and confirm every API call returns an Access-Control-Allow-Origin header for that origin. (test class: End-to-end tests)
- [ ] PR-03 Diff the Access-Control-Allow-Origin, Access-Control-Allow-Headers and Access-Control-Allow-Methods responses of the release candidate against production for each frontend origin. (test class: Security tests)
- [ ] PR-04 Send a preflight OPTIONS request carrying every header the frontend sends, including tracing headers such as baggage, and confirm each one is listed in Access-Control-Allow-Headers. (test class: Security tests)
- [ ] PR-05 After upgrading a frontend dependency, list the request headers it adds and confirm the allowed headers policy covers each of them. (test class: Security tests)
- [ ] PR-06 Run a browser-based synthetic login from each custom domain every few minutes after deploy and alert on the first failure. (test class: Synthetic monitoring)
- [ ] PR-07 Make the synthetic login check alert on any 500 response from login URLs. (test class: Synthetic monitoring)