Test your knowledge: CORS Server-Side

Question 1 of 6

Beacons always send `credentials: 'include'`. What does that forbid on the server?

Credentialed requests require the server to echo the exact origin — not a placeholder.

Answer options A Access-Control-Allow-Origin: * — the wildcard is banned for credentialed responses B Any Access-Control-Allow-Origin header at all C HTTP/2 for the collector endpoint D Session cookies on the request

The CORS protocol refuses the wildcard for credentialed requests. The server must echo the specific Origin (e.g. https://app.example.com) in Access-Control-Allow-Origin, and include Access-Control-Allow-Credentials: true — the literal string, not '1'.

Review this lesson

Question 2 of 6

Which three headers must a cross-origin beacon collector return?

One echoes the origin, one permits credentials, one keeps caches from cross-origin leakage.

Answer options A Access-Control-Allow-Origin, Access-Control-Allow-Credentials, Vary: Origin B Access-Control-Allow-Origin, Access-Control-Expose-Headers, Content-Type C Access-Control-Allow-Methods, Access-Control-Max-Age, Vary: Origin D Timing-Allow-Origin, Access-Control-Allow-Credentials, Vary: *

ACAO echoes the exact origin (never *), ACA-Credentials: true permits the credentialed request, and Vary: Origin stops shared caches from serving one origin's allowed response to another. Multi-tenant collectors must derive all three per request.

Review this lesson

Question 3 of 6

Safari's Intelligent Tracking Prevention affects cross-site beacons how?

The classification is script-level and domain-based, and the cap is on storage AND requests.

Answer options A It blocks beacons to third-party collectors after 7 days without first-party interaction B It strips credentials from all cross-origin requests C It caps cross-site beacons at 10 per page load D It has no effect — ITP only targets cookies in responses

ITP classifies the script's domain as tracker if it has not seen first-party interaction in the last 7 days (capped at 24h in newer versions for some classifications) — then cookies are partitioned or blocked, so credentialed beacons to that collector silently lose their identity.

Review this lesson

Question 4 of 6

Your JSON-typed beacon triggers a CORS preflight that the server answers wrongly. What does the client see?

The boolean answered a question about queueing, minutes before the preflight ran.

Answer options A A console CORS error AND sendBeacon returning false B A console CORS error — but sendBeacon already returned true C Nothing at all — the browser hides beacon CORS failures D An unhandled promise rejection

The preflight happens asynchronously after sendBeacon has returned its queueing boolean. DevTools shows the CORS failure, the caller sees nothing — there is no rejection channel from a synchronous boolean API.

Review this lesson

Question 5 of 6

When should you use `fetch(url, { keepalive: true, credentials: 'omit' })` instead of `sendBeacon`?

sendBeacon hard-codes include; only the fetch form lets you choose.

Answer options A When the payload is JSON — fetch never triggers preflights B When the beacon must NOT send cookies — e.g. anonymous, origin-agnostic telemetry C When you need the response body D Never — credentials omit is forbidden with keepalive

sendBeacon forces credentials: 'include', which drags cookies and forbids the wildcard. For cookieless telemetry — where the server can then use ACAO: * — fetch(keepalive) with credentials: 'omit' is the right tool.

Review this lesson

Question 6 of 6

The `cors-collector.ts` reference recipe is a…

CORS is a server-side contract — the recipe completes the story the client recipes started.

Answer options A Client-side CORS polyfill B Server-side reference collector that answers beacons and preflights correctly C Proxy that rewrites beacon URLs to same-origin D Browser extension that fixes CORS devtools filtering

The collector validates the Origin against an allowlist, echoes ACAO with the exact origin, sets ACA-Credentials: true and Vary: Origin, answers OPTIONS preflights with the right methods, and returns 204 No Content — the beacon-idiomatic response.

Review this lesson

Test your knowledge: CORS Server-Side