Cross-Origin Requests

A page can call Looking Glass with fetch from any origin and read the reflection. Use it to see what a frontend really sends, without a proxy in between.

At a Glance

• Looking Glass running (see Getting Started).
• A page on any origin, localhost or deployed.

From a Page

const res = await fetch('http://localhost:8080/api/users', {
  method: 'POST',
  credentials: 'include',
  headers: { 'Content-Type': 'application/json', 'X-Glass-Format': 'json' },
  body: JSON.stringify({ name: 'ada' }),
})

console.log(await res.json())

Every response allows the page's Origin, with credentials, so cookies and Authorization go through and show up in the reflection. A request without an Origin gets Access-Control-Allow-Origin: *.

Preflights

A preflight (an OPTIONS with Origin and Access-Control-Request-Method) is answered 204, allowing the method and headers it asked for, and cached by the browser for an hour. It isn't reflected, since the browser never shows its body; the activity log still records it as preflight.

Any other OPTIONS request is reflected like the rest.

Next Steps

• Status and Delay: make the page's request fail, or wait.
• Response Formats: HTML or JSON.