{"actions":{"bootstrapAndRun":{"effect":"installs rote if missing, inspects, prepares, and asks before running","href":"https://play.modiqo.ai/install?play=chinmoy/cors-mismatch@0.2.0","method":"GET","rel":"https://rote.dev/rels/bootstrap-and-run","requiresConsent":true,"responseMediaType":"text/x-shellscript"},"inspect":{"command":"rote play inspect https://play.modiqo.ai/chinmoy/cors-mismatch@0.2.0","effect":"read-only"},"installCliOnly":{"effect":"installs the rote CLI, nothing else","href":"https://play.modiqo.ai/install","method":"GET","rel":"https://rote.dev/rels/install-cli","requiresConsent":true,"responseMediaType":"text/x-shellscript"},"run":{"command":"rote play run https://play.modiqo.ai/chinmoy/cors-mismatch@0.2.0","effect":"executes the play locally after consent","headless":{"approvalAssertion":"--yes","approvalRequiredBeforeInvocation":true,"commandTemplate":"rote play run https://play.modiqo.ai/chinmoy/cors-mismatch@0.2.0 <name=value...> --yes","stdinPolicy":"never pipe input to automate the interactive Ready selector"},"requiresConsent":true}},"description":"Reads both halves of a repository and answers whether the browser will refuse your own frontend's calls to your own backend. 8 probes derive every origin the browser sends from (vite server.port, next and create-react-app defaults, package.json homepage, CNAME), every base URL the client calls (fetch, axios, ky, VITE_ and NEXT_PUBLIC_ defaults), and the allowlist the server declares (express cors, FastAPI CORSMiddleware, Flask-CORS, Django, Spring, nginx), then pairs them into ALLOWED, BLOCKED or BLOCKED-AT-PREFLIGHT with a file and line on both sides. Registration order is read across files, one level deep, so an express app that calls cors() in app.js and mounts auth from routes/index.js is reported with both file:line locations, as is a Django MIDDLEWARE entry or a Starlette add_middleware naming a local module. Comments, docstrings, tests and vendored trees are never read for a finding. It does not contact a server, require one running, or follow an import git does not track, and it reports UNKNOWN rather","distribution":{"digest":"sha256:6506fdb4bf9c256b692cf43d00750bc58d65d04b436410c4124bfb44c4d06865","mediaType":"application/vnd.modiqo.rote-flow","size":53672,"verifiedBy":"rote verifies the downloaded archive against this digest before it runs"},"effects":{"credentialsProvidedBy":"runner","credentialsRemainLocal":true,"declaredWrites":[],"publisherReceivesCredentials":false},"id":"https://play.modiqo.ai/chinmoy/cors-mismatch@0.2.0","inputPolicy":{"optionalWithDefault":"show_default_and_accept_override","optionalWithoutDefault":"omit_unless_supplied","required":"ask","secrets":"collect_locally_outside_conversation"},"links":{"docs":"https://rote.dev","page":"https://play.modiqo.ai/chinmoy/cors-mismatch@0.2.0","protocol":"https://play.modiqo.ai/.well-known/rote","self":"https://play.modiqo.ai/chinmoy/cors-mismatch@0.2.0.json"},"name":"cors-mismatch","owner":{"kind":"user","slug":"chinmoy"},"parameters":[{"default":".","description":"Work tree to read. The default '.' resolves to the directory the run started in, so a zero-argument run answers for the repository you are standing in; pass an absolute path to answer for a checkout somewhere else. Only tracked files are read, because an uncommitted scratch config is not what a teammate or a deploy will get.","input":{"allowCustom":true,"choices":[],"label":"Path"},"name":"path","required":false,"type":"string"},{"default":false,"description":"Whether test, spec, fixture and mock directories are read. The default false leaves them out, because a test that deliberately builds a broken CORS config is the single most common false positive in this class of check and reporting it sends someone to edit a passing test. Set true when your application code genuinely lives under a directory named test.","input":{"allowCustom":true,"choices":[],"label":"Include tests"},"name":"include_tests","required":false,"type":"boolean"},{"default":false,"description":"Whether example, demo, sandbox, playground and benchmark directories are read. The default false leaves them out, because a sample app in examples/ is written to be copied and its localhost origins are not the ones your deployment uses. Set true when the example directory is the application you actually ship.","input":{"allowCustom":true,"choices":[],"label":"Include examples"},"name":"include_examples","required":false,"type":"boolean"},{"default":true,"description":"Whether a framework's default development port is assumed when no port is declared. The default true adds 5173 for vite, 3000 for next and create-react-app and 4200 for angular, which is the port a contributor's browser really uses and therefore the origin that really gets blocked. Set false to reason only about ports the repository states in writing.","input":{"allowCustom":true,"choices":[],"label":"Assume dev ports"},"name":"assume_dev_ports","required":false,"type":"boolean"},{"default":true,"description":"Whether development proxies are read and compared against production rewrites. The default true reports a proxy that makes a call same-origin in development while nothing covers the same route in production, which is why the failure appears only after deploy. Set false when you route every request through an ingress that is configured outside this repository.","input":{"allowCustom":true,"choices":[],"label":"Check proxy"},"name":"check_proxy","required":false,"type":"boolean"},{"default":true,"description":"Whether registration order is followed one level across files. The default true reads the file that registers CORS and then opens the single local module it mounts ahead of that registration - a router required from ./routes, a Django MIDDLEWARE entry naming this project's own dotted path, a Starlette add_middleware class imported from a sibling file - and reports the mount site and the auth registration inside it as two file and line locations, because an express app that calls cors() in app.js and mounts auth from routes/index.js is the commonest real shape of this failure and no single file shows it. Exactly one level is followed, and only into a path git already tracks; node_modules and site-packages are never entered, and an import that does not resolve is dropped in silence rather than guessed at. Set false to read every file on its own, which is what version 0.1.0 did.","input":{"allowCustom":true,"choices":[],"label":"Follow mounts"},"name":"follow_mounts","required":false,"type":"boolean"},{"description":"Comma-separated origins to test against the allowlist in addition to the ones found. The default is empty because every origin the repository states is already derived; add an origin here when the site is served from a domain the repository never names, such as a preview URL or a customer's own domain.","input":{"allowCustom":true,"choices":[],"label":"Extra origins"},"name":"extra_origins","required":false,"type":"string"},{"description":"Comma-separated origins to treat as this project's own backend rather than a third-party API. The default is empty, and any host on a well known third-party domain is reported as external and never flagged, because another company's CORS policy is not decidable from your repository. Name your API host here when it lives on a domain that looks third-party.","input":{"allowCustom":true,"choices":[],"label":"Backend origins"},"name":"backend_origins","required":false,"type":"string"},{"default":"all","description":"Which findings reach the report: all, or critical. The default all keeps the warnings, because an echoed Origin header and a proxy with no production counterpart are both worth seeing once even though neither blocks a request today; use critical for only what a browser will refuse outright.","input":{"allowCustom":true,"choices":[],"label":"Severity"},"name":"severity","required":false,"type":"string"},{"default":12,"description":"How many origin-to-target pairs are listed. The default 12 keeps the report readable on one screen, worst first, and the count of pairs not listed is always printed so nothing is silently dropped. Raise it when a repository serves several frontends and you want the whole matrix.","input":{"allowCustom":true,"choices":[],"label":"Max pairs"},"name":"max_pairs","required":false,"type":"integer"},{"default":1500,"description":"Upper bound on how many files have their contents read. The default 1500 covers every application repository tested and keeps a run on a large monorepo to a few seconds; the number of files actually read is always reported, so a bound that was hit is visible rather than silently narrowing the answer.","input":{"allowCustom":true,"choices":[],"label":"Max files"},"name":"max_files","required":false,"type":"integer"}],"preparation":[{"action":{"command":"rote play inspect https://play.modiqo.ai/chinmoy/cors-mismatch@0.2.0 --json","effect":"read-only"},"step":1,"type":"inspect_local_readiness"},{"references":["/parameters"],"step":2,"type":"collect_parameters"},{"references":["/parameters","/requirements","/effects"],"step":3,"type":"review"},{"consentBoundary":"the user approves the exact play and parameter values","references":["/parameters","/requirements","/effects"],"step":4,"type":"obtain_run_consent"},{"action":{"command":"rote play run https://play.modiqo.ai/chinmoy/cors-mismatch@0.2.0","headlessCommandTemplate":"rote play run https://play.modiqo.ai/chinmoy/cors-mismatch@0.2.0 <name=value...> --yes"},"preservesAcquisitionBoundaries":["adapter_selection","oauth_dcr","google_discovery","static_token_setup","runtime_security_checks"],"requiresConsent":true,"step":5,"type":"run"}],"producedBy":{"roteVersion":"0.79.0"},"publishedAt":"2026-09-04T07:53:41.198419+00:00","reference":"chinmoy/cors-mismatch@0.2.0","requirements":{"adapters":[],"browser":{"dependencies":[],"runtime":false,"signIn":false},"localTools":["git","python3"],"roteCli":{"minimumVersion":"0.62.0"},"sessions":false},"resolution":"pinned","schema":"rote.play.v1","stats":{"downloads":3,"installs":0},"steps":{"count":8,"names":["api_targets","dev_proxy","frontend_origins","invalid_combos","middleware_order","repo_survey","server_config","verdict"]},"title":"cors-mismatch","type":"play","version":"0.2.0","visibility":"public"}