Practice · 3 of 3

CORS Decision Engine

Write corsDecision(origin, allowedOrigins, credentials) — origin is the request's Origin header; allowedOrigins is an array (may contain "*"); credentials is boolean. Rules: origin not in list (and no "*") => "deny"; "*" with credentials => "deny" (forbidden combo); origin in list (or "*") without credentials => "allow"; origin in list with credentials => "allow-with-credentials".

Difficulty: intermediate

Press Submit to check your solution.

Back to lesson: Practice: Headers & CORS — Practice