Comparison
CORSvsOpaque response
CORS
the request worked in curl and failed in the browser with a message about an Access-Control header.
The protocol by which a server tells the browser which other origins may read its responses, using `Access-Control-Allow-*` headers. It is entirely enforced by the browser and entirely configured on the server, which is why no amount of client-side code fixes a CORS error. Wildcarding the allowed origin is fine for public data and forbidden with credentials, which is where most misconfigurations start.
Full entry →Opaque response
the fetch resolved successfully but the status was 0 and the body was empty.
The result of a `no-cors` request: it was sent and may have succeeded, but the browser will not let you see the status, the headers or the body. It exists so that cross-origin resources can be fetched for use by the browser itself, as an image or a cached asset. Caching one in a service worker is a trap, because you cannot tell a successful response from a 404.
Full entry →