FS26
Ctrl K
Phase 18 · Lesson 08

CORS Authorization Headers and Preflight

≈ 2 min core reading · 211 source/companion words
Learning contract

What you should be able to do after this

  • Explain CORS Authorization Headers and Preflight without relying on framework buzzwords.
  • Connect the lesson to the phase outcome: Make NestJS independently verify Supabase access tokens and attach trusted identity before protected handlers run.
  • Reproduce the relevant behavior and verify it with evidence.
  • Diagnose at least one representative failure instead of guessing.
Figure 18.8 — TaskFlow boundary map
Next.js session
Bearer access token
NestJS guard
Supabase/JWT verification
trusted request user
controller/service
This lesson belongs to Phase 18. Keep the full request/data path visible even when today's code changes only one box.
Instructor workflow: predict first → implement the smallest slice → run it → inspect evidence → break one assumption → diagnose → explain it back. Do not copy the whole code block before understanding the first failing boundary.

CORS and Authorization Headers Why browser bearer requests can trigger preflight

Phase 18 trust boundary

Next.js authenticated session

Authorization: Bearer <access token>

NestJS authentication guard

Verified Supabase identity

Controller and business service

Course principle: a user ID becomes trusted only after the access token has been cryptographically verified by the backend.

Browser path

Cross-origin authenticated request

Browser Client Component

OPTIONS preflight when required

NestJS CORS policy

Actual request with Authorization

AuthGuard verifies token

NestJS CORS configuration app.enableCors({ origin: 'http://localhost:3000', methods: ['GET', 'POST', 'PATCH', 'DELETE', 'OPTIONS'], allowedHeaders: [ 'Content-Type', 'Authorization', ], })

Important distinction CORS does not verify the access token. CORS controls whether browser JavaScript may make/read cross-origin requests. The AuthGuard verifies authentication.

Server-to-server path A Next.js Server Component calling NestJS from the server is not subject to the browser's CORS enforcement. The bearer token still must be verified because CORS and authentication solve different problems.

Common debugging sequence • Does Network show an OPTIONS request?

• Does the preflight response allow Authorization?

• Does the actual request contain Authorization: Bearer ...?

• Does NestJS return 401 from the guard or was the browser blocked before the request? Source note: verified against current Supabase Auth/getClaims/signing-key guidance and NestJS authentication/authorization docs. Full URLs and version notes are included in SOURCE_NOTES.txt.

Executable lesson studio · cors

Now turn the explanation into engineering skill.

CORS Authorization Headers and Preflight matters because it changes a real boundary in TaskFlow. The goal is to understand the inputs, owner, observable output, and failure modes before adding more abstraction.

By the end, you should be able to

  • Explain CORS Authorization Headers and Preflight in terms of concrete inputs, ownership, outputs, and evidence.
  • Implement or reproduce the smallest TaskFlow slice that demonstrates this cors concept.
  • Diagnose one representative cors failure using observable evidence instead of trial-and-error.
Figure 18.8B — Mental model
User intent
UI boundary
API contract
business rule
persistence
observable result
Read left-to-right while implementing. When debugging, walk right-to-left until the first observed fact differs from your prediction.
Code-along sequence

One coherent change at a time

  1. 01

    Restate the goal of “CORS Authorization Headers and Preflight” as one observable behavior. Write the success signal before touching code.

  2. 02

    Trace the boundary map: User intent → UI boundary → API contract → business rule → persistence → observable result. Mark the one boundary this lesson changes.

  3. 03

    Inspect the current repository state and record the exact files, route, table, or runtime involved. Avoid creating an abstraction before you can name the existing owner.

  4. 04

    Implement the smallest vertical slice. Add one coherent change, run the narrowest verification command, and read the output before continuing.

  5. 05

    Connect the slice to TaskFlow’s phase artifact: Authentication guard + verification service + current-user helper + protected /auth/me and task routes.. Verify behavior from the outside as a user or API client would.

  6. 06

    Create one controlled failure that is safe to reproduce. Predict the symptom first, capture evidence, locate the earliest broken boundary, then fix only that cause.

  7. 07

    Close the reference and rebuild or explain the core change from memory. Record what you would monitor or test before trusting the same change in production.

httpInspect the browser preflight contract
OPTIONS /tasks HTTP/1.1
Origin: http://localhost:3000
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization,content-type

HTTP/1.1 204 No Content
Access-Control-Allow-Origin: http://localhost:3000

Do not copy this as a finished answer. Predict what each boundary does, type the smallest useful slice, run it, then compare the result with your prediction.

Verification

Prove the happy path

  1. Run the narrowest relevant command or request and require a clean exit/status.
  2. Inspect the boundary-specific evidence: terminal output, Network panel, database row/query plan, test report, container health, or deployment logs.
  3. Repeat the behavior once after the change so a one-off cached or stale result cannot masquerade as success.
Break it on purpose

Build debugging memory

  1. Logging bearer tokens during debugging
  2. Change one assumption in the cors example—identity, input, configuration, ordering, connectivity, or state—and predict the exact symptom before running it.
SymptomInvestigation path
Expected result does not appear

Return to the nearest observable boundary: input, network, process log, database, or rendered UI. Compare actual evidence with the predicted path.

A shortcut appears to fix it

Change one variable at a time and reproduce the original failure after the fix; otherwise you have correlation, not diagnosis.

Closed-reference challenge

Can you transfer the idea?

Without copying the final source, create a second small scenario that applies “CORS Authorization Headers and Preflight” to a different TaskFlow resource or input. Write the acceptance criteria first, implement it, and provide the evidence that each criterion is satisfied.

Explain-back

Answer these without reopening the solution

  1. What problem does CORS Authorization Headers and Preflight solve in TaskFlow, and what would be observably wrong without it?
  2. Which part of the cors boundary owns the decision, and which neighboring layer must not own it?
  3. What evidence proves the happy path instead of merely suggesting it worked?
  4. Name one realistic failure or abuse case and the first place you would inspect.
  5. If requirements doubled tomorrow, which part of this design should stay stable and which part is allowed to change?
Lesson studio

Turn the reading into skill

01

Do it

Extract and validate the bearer scheme in a guard with clear missing/malformed behavior.

Use the smallest change that demonstrates this lesson. Stop after it works and capture evidence.
02

Break it safely

Logging bearer tokens during debugging

Predict the symptom before causing the failure. Then locate the earliest boundary where reality diverges from expectation.
03

Explain it back

Why does this responsibility live here, what input does it trust, what output proves success, and what would go wrong if another layer owned it?

If your explanation is vague, repeat the boundary trace before moving on.
Exit ticket

Before marking complete

Close the reference. Reproduce the core idea from memory or explain the exact request/data flow aloud. Then check your diff or notes for accidental shortcuts that bypass validation, authorization, error handling, or verification earned in earlier phases.

← 401 Error Semantics and Client RecoverySigning Keys JWKS and 2026 Supabase Choices →