{"actions":{"bootstrapAndRun":{"effect":"installs rote if missing, inspects, prepares, and asks before running","href":"https://play.modiqo.ai/install?play=chinmoy/cors-mismatch@0.1.0","method":"GET","rel":"https://rote.dev/rels/bootstrap-and-run","requiresConsent":true,"responseMediaType":"text/x-shellscript"},"inspect":{"command":"rote play inspect https://play.modiqo.ai/chinmoy/cors-mismatch@0.1.0","effect":"read-only"},"installCliOnly":{"effect":"installs the rote CLI, nothing else","href":"https://play.modiqo.ai/install","method":"GET","rel":"https://rote.dev/rels/install-cli","requiresConsent":true,"responseMediaType":"text/x-shellscript"},"run":{"command":"rote play run https://play.modiqo.ai/chinmoy/cors-mismatch@0.1.0","effect":"executes the play locally after consent","headless":{"approvalAssertion":"--yes","approvalRequiredBeforeInvocation":true,"commandTemplate":"rote play run https://play.modiqo.ai/chinmoy/cors-mismatch@0.1.0 <name=value...> --yes","stdinPolicy":"never pipe input to automate the interactive Ready selector"},"requiresConsent":true}},"description":"Reads both halves of a repository and answers whether the browser will refuse your own frontend's calls to your own backend. 8 probes derive every origin the browser sends from (vite server.port, next and create-react-app defaults, package.json homepage, CNAME), every base URL the client calls (fetch, axios, ky, VITE_ and NEXT_PUBLIC_ defaults), and the allowlist the server declares (express cors, FastAPI CORSMiddleware, Flask-CORS, Django, Spring, nginx), then pairs them into ALLOWED, BLOCKED or BLOCKED-AT-PREFLIGHT with a file and line on both sides. It names the development proxy that keeps a mismatch invisible until deploy, and the middleware registered ahead of CORS that answers the OPTIONS preflight with 401. Comments, docstrings, tests and vendored trees are never read for a finding, and a star origin without credentials is not reported. It does not contact a server, require one running, or read a credential, and it reports UNKNOWN rather than a pass whenever either half is missing. Catches the deploy","distribution":{"digest":"sha256:f6fc209a947a2f88088d0c861c370d298d0eb33722d3ebc527d46ec70f0dd3d3","mediaType":"application/vnd.modiqo.rote-flow","size":48709,"verifiedBy":"rote verifies the downloaded archive against this digest before it runs"},"effects":{"credentialsProvidedBy":"runner","credentialsRemainLocal":true,"declaredWrites":[],"publisherReceivesCredentials":false},"id":"https://play.modiqo.ai/chinmoy/cors-mismatch@0.1.0","inputPolicy":{"optionalWithDefault":"show_default_and_accept_override","optionalWithoutDefault":"omit_unless_supplied","required":"ask","secrets":"collect_locally_outside_conversation"},"links":{"docs":"https://rote.dev","page":"https://play.modiqo.ai/chinmoy/cors-mismatch@0.1.0","protocol":"https://play.modiqo.ai/.well-known/rote","self":"https://play.modiqo.ai/chinmoy/cors-mismatch@0.1.0.json"},"name":"cors-mismatch","owner":{"kind":"user","slug":"chinmoy"},"parameters":[{"default":".","description":"Work tree to read. The default '.' resolves to the directory the run started in, so a zero-argument run answers for the repository you are standing in; pass an absolute path to answer for a checkout somewhere else. Only tracked files are read, because an uncommitted scratch config is not what a teammate or a deploy will get.","input":{"allowCustom":true,"choices":[],"label":"Path"},"name":"path","required":false,"type":"string"},{"default":false,"description":"Whether test, spec, fixture and mock directories are read. The default false leaves them out, because a test that deliberately builds a broken CORS config is the single most common false positive in this class of check and reporting it sends someone to edit a passing test. Set true when your application code genuinely lives under a directory named test.","input":{"allowCustom":true,"choices":[],"label":"Include tests"},"name":"include_tests","required":false,"type":"boolean"},{"default":false,"description":"Whether example, demo, sandbox, playground and benchmark directories are read. The default false leaves them out, because a sample app in examples/ is written to be copied and its localhost origins are not the ones your deployment uses. Set true when the example directory is the application you actually ship.","input":{"allowCustom":true,"choices":[],"label":"Include examples"},"name":"include_examples","required":false,"type":"boolean"},{"default":true,"description":"Whether a framework's default development port is assumed when no port is declared. The default true adds 5173 for vite, 3000 for next and create-react-app and 4200 for angular, which is the port a contributor's browser really uses and therefore the origin that really gets blocked. Set false to reason only about ports the repository states in writing.","input":{"allowCustom":true,"choices":[],"label":"Assume dev ports"},"name":"assume_dev_ports","required":false,"type":"boolean"},{"default":true,"description":"Whether development proxies are read and compared against production rewrites. The default true reports a proxy that makes a call same-origin in development while nothing covers the same route in production, which is why the failure appears only after deploy. Set false when you route every request through an ingress that is configured outside this repository.","input":{"allowCustom":true,"choices":[],"label":"Check proxy"},"name":"check_proxy","required":false,"type":"boolean"},{"description":"Comma-separated origins to test against the allowlist in addition to the ones found. The default is empty because every origin the repository states is already derived; add an origin here when the site is served from a domain the repository never names, such as a preview URL or a customer's own domain.","input":{"allowCustom":true,"choices":[],"label":"Extra origins"},"name":"extra_origins","required":false,"type":"string"},{"description":"Comma-separated origins to treat as this project's own backend rather than a third-party API. The default is empty, and any host on a well known third-party domain is reported as external and never flagged, because another company's CORS policy is not decidable from your repository. Name your API host here when it lives on a domain that looks third-party.","input":{"allowCustom":true,"choices":[],"label":"Backend origins"},"name":"backend_origins","required":false,"type":"string"},{"default":"all","description":"Which findings reach the report: all, or critical. The default all keeps the warnings, because an echoed Origin header and a proxy with no production counterpart are both worth seeing once even though neither blocks a request today; use critical for only what a browser will refuse outright.","input":{"allowCustom":true,"choices":[],"label":"Severity"},"name":"severity","required":false,"type":"string"},{"default":12,"description":"How many origin-to-target pairs are listed. The default 12 keeps the report readable on one screen, worst first, and the count of pairs not listed is always printed so nothing is silently dropped. Raise it when a repository serves several frontends and you want the whole matrix.","input":{"allowCustom":true,"choices":[],"label":"Max pairs"},"name":"max_pairs","required":false,"type":"integer"},{"default":1500,"description":"Upper bound on how many files have their contents read. The default 1500 covers every application repository tested and keeps a run on a large monorepo to a few seconds; the number of files actually read is always reported, so a bound that was hit is visible rather than silently narrowing the answer.","input":{"allowCustom":true,"choices":[],"label":"Max files"},"name":"max_files","required":false,"type":"integer"}],"preparation":[{"action":{"command":"rote play inspect https://play.modiqo.ai/chinmoy/cors-mismatch@0.1.0 --json","effect":"read-only"},"step":1,"type":"inspect_local_readiness"},{"references":["/parameters"],"step":2,"type":"collect_parameters"},{"references":["/parameters","/requirements","/effects"],"step":3,"type":"review"},{"consentBoundary":"the user approves the exact play and parameter values","references":["/parameters","/requirements","/effects"],"step":4,"type":"obtain_run_consent"},{"action":{"command":"rote play run https://play.modiqo.ai/chinmoy/cors-mismatch@0.1.0","headlessCommandTemplate":"rote play run https://play.modiqo.ai/chinmoy/cors-mismatch@0.1.0 <name=value...> --yes"},"preservesAcquisitionBoundaries":["adapter_selection","oauth_dcr","google_discovery","static_token_setup","runtime_security_checks"],"requiresConsent":true,"step":5,"type":"run"}],"producedBy":{"roteVersion":"0.79.0"},"publishedAt":"2026-09-04T02:50:36.90019+00:00","reference":"chinmoy/cors-mismatch@0.1.0","requirements":{"adapters":[],"browser":{"dependencies":[],"runtime":false,"signIn":false},"localTools":["git","python3"],"roteCli":{"minimumVersion":"0.62.0"},"sessions":false},"resolution":"pinned","schema":"rote.play.v1","stats":{"downloads":1,"installs":0},"steps":{"count":8,"names":["api_targets","dev_proxy","frontend_origins","invalid_combos","middleware_order","repo_survey","server_config","verdict"]},"title":"cors-mismatch","type":"play","version":"0.1.0","visibility":"public"}