Browser Preflight Header Allowlist Integrity Automation: A Test That Could Never Have Caught Its Own Bug

Some rules exist entirely inside the browser itself, enforced before a request is even allowed to leave — a preflight check for cross-origin requests is exactly that kind of rule. A test that calls the same backend endpoint directly, server to server, never passes through a browser at all, and therefore never exercises that rule either way. It is not a weaker test of the same thing; it is a test of a genuinely different thing that happens to hit the same URL. Passing it proves the server-side code works. It proves nothing about whether a browser would ever have been allowed to reach that code in the first place.

Centriu Axiom's own client library injects a specific custom header, identifying which organization the current request concerns, into every single outgoing request. A separate, shared piece of configuration — used by every backend Edge Function across the codebase — declares which headers a cross-origin browser request is allowed to include; anything not on that list causes the browser itself to block the entire request during its preflight check, before the actual request, and any server code behind it, ever runs.

The header Axiom's client always sends was not on that shared list. Every request from a genuine browser running the Axiom interface against an affected Edge Function would have been blocked outright by the browser, silently, with the server never seeing it at all. Confirmed directly from the fix's own account of how this stayed undetected: every previous test of the same endpoints used a direct, server-to-server call — a call that never includes an `Origin` header and therefore never triggers a browser's cross-origin preflight mechanism in the first place. Those tests passed reliably, every time, because they were testing something the missing header genuinely had no effect on. Only a real, browser-based end-to-end test — credited directly in the fix's own text to a specific browser-testing round — could have exercised the actual mechanism that was broken, and did.

The missing header was added to the shared allowlist to close the gap. In the same change, made out of an abundance of caution, a second, different custom header was added alongside it — one used elsewhere in the system for labeling which internal surface originated a given call. A pre-deployment audit, conducted the same morning, traced who actually sends that second header and found the answer was: only one Edge Function calling a different Edge Function directly, server to server — a call that, like the tests before it, never carries an `Origin` header and therefore never goes through the browser's cross-origin check at all. No browser anywhere sends it. Keeping it on a shared allowlist used by every backend endpoint in the codebase would have meant every one of those endpoints carried a slightly larger attack surface for zero actual benefit to any real caller.

The second header was removed, and the underlying test was rewritten to check minimality in both directions at once: every header the client is confirmed to actually send must be on the allowlist (catching the original bug), and every header on the allowlist must have a real, identified sender (catching the over-correction). The project's own integration documentation, which had separately instructed a different consuming application to send the now-removed header, was corrected in the same pass — specifically because leaving that guidance in place would have led the next system integrating with Axiom directly into the identical class of defect.

A team runs its full automated test suite against a newly deployed set of Edge Functions and sees every test pass, including tests that specifically exercise the endpoint the Axiom client depends on. A person then opens the actual Axiom interface in a real browser and finds every one of those same calls fails immediately, with no server-side error to investigate, because the browser itself refused to send the request in the first place. After the fix, the identical browser session succeeds, because the header the client always sends is now on the list the browser checks before allowing the request through.

Centriu Axiom's browser client can now successfully reach every backend Edge Function using the shared preflight allowlist, with that allowlist containing exactly the headers real browsers are confirmed to send — verified by a test that checks both that nothing needed is missing and that nothing unnecessary was added.

This automation governs a specific, internal browser-compatibility mechanism for Centriu Axiom's own Edge Functions — it does not change what data or actions any endpoint authorizes, does not affect server-to-server integrations (which never go through a browser's preflight check), and is not a general-purpose CORS configuration tool for a customer's own separately-hosted systems.

A server-to-server test is faster to write, faster to run, and genuinely useful for validating everything that happens once a request has already been allowed through — but it structurally cannot validate the ONE mechanism, browser preflight enforcement, that exists specifically to run before that point. Relying on server-to-server coverage alone for an endpoint a real browser will call means the one class of bug this incident represents — a real, total, browser-only failure — has no test capable of catching it, no matter how comprehensive the rest of the suite becomes. A genuine browser-based test is the only kind that closes that specific gap.