# Edge Function CORS: the preflight your handler never sees
CORS failures happen before your function logic runs, which is why auth debugging goes nowhere. The browser asks permission with OPTIONS; no valid answer means the real request is never sent.
## Symptom to cause to confirmation to fix
1. Confirm it is CORS: the browser console shows a CORS error and the network tab shows an OPTIONS request with no successful response. curl succeeding while the browser fails is the definitive signature.
2. Handle OPTIONS explicitly at the top of the function: return a 200 with `Access-Control-Allow-Origin`, `Access-Control-Allow-Headers` (including `authorization` and any custom headers your client sends), and `Access-Control-Allow-Methods`.
3. Include the CORS headers on every real response too, not just OPTIONS. A successful preflight followed by a response without the headers still fails.
4. Match the allowed origin to your app's origin in production. A wildcard is fine for dev and sloppy for production; enumerate the origins you serve.
5. If the client sends credentials or custom headers, they must be in the allow-headers list by name. A missing header name fails the preflight even when everything else is right.
## Verification
Call the function from the browser and confirm no CORS errors. Then call it from an unexpected origin and confirm it is rejected. Both directions prove the policy is deliberate.