---
url: https://lookingglass.kloudkit.com/guide/cross-origin-requests.md
description: >-
  Call Looking Glass with fetch from a page on another origin, credentials and
  custom headers included.
---

# Cross-Origin Requests

A page can call Looking Glass with `fetch` from any origin and read the reflection.
Use it to see what a frontend really sends, without a proxy in between.

## At a Glance

* Looking Glass running *(see [Getting Started](./getting-started))*.
* A page on any origin, `localhost` or deployed.

## From a Page

```js
const res = await fetch('http://localhost:8080/api/users', {
  method: 'POST',
  credentials: 'include',
  headers: { 'Content-Type': 'application/json', 'X-Glass-Format': 'json' },
  body: JSON.stringify({ name: 'ada' }),
})

console.log(await res.json())
```

Every response allows the page's `Origin`, with credentials, so cookies and
`Authorization` go through and show up in the reflection.
A request without an `Origin` gets `Access-Control-Allow-Origin: *`.

## Preflights

A preflight *(an `OPTIONS` with `Origin` and `Access-Control-Request-Method`)* is answered
`204`, allowing the method and headers it asked for, and cached by the browser for an hour.
It isn't reflected, since the browser never shows its body; the activity log still records
it as `preflight`.

Any other `OPTIONS` request is reflected like the rest.

## Next Steps

* [Status and Delay](./status-and-delay): make the page's request fail, or wait.
* [Response Formats](./response-formats): HTML or JSON.