# Fix: CORS preflight (OPTIONS) succeeds with Access-Control-Allow-* headers

> Web-audit fix skill for the `mcp-cors-preflight` check (MCP, SHOULD).

## Goal

Serve one consistent CORS posture on the MCP endpoint, full preflight support or none.

## Fix

The audit scores CORS posture, not presence. Omitting `Access-Control-Allow-Origin` from
both the `OPTIONS` preflight and the `POST` response is a consistent no-CORS posture (a
server-to-agent-only endpoint) and scores `n_a` with no penalty. This check fails only when
the posture is partial or misconfigured: the preflight carries `Access-Control-Allow-Origin`
on a non-2xx response, or the `POST` carries it while the preflight does not. To support
browser-origin agents, answer the preflight with `204` (or `200`) plus
`Access-Control-Allow-Origin`, `Access-Control-Allow-Methods`, and
`Access-Control-Allow-Headers`, and mirror `Access-Control-Allow-Origin` on the `POST`
response. To stay no-CORS, strip the headers from both surfaces.

## Resources

- [MDN CORS preflight](https://developer.mozilla.org/en-US/docs/Glossary/Preflight_request)

## Copy-paste prompt

Paste this into your coding agent. [Your audit](https://anc.dev/audit) adds what it observed for this check:

```text
Goal: Serve one consistent CORS posture on the MCP endpoint, full preflight support or none
Fix: The audit scores CORS posture, not presence. Omitting `Access-Control-Allow-Origin` from both the `OPTIONS` preflight and the `POST` response is a consistent no-CORS posture (a server-to-agent-only endpoint) and scores `n_a` with no penalty. This check fails only when the posture is partial or misconfigured: the preflight carries `Access-Control-Allow-Origin` on a non-2xx response, or the `POST` carries it while the preflight does not. To support browser-origin agents, answer the preflight with `204` (or `200`) plus `Access-Control-Allow-Origin`, `Access-Control-Allow-Methods`, and `Access-Control-Allow-Headers`, and mirror `Access-Control-Allow-Origin` on the `POST` response. To stay no-CORS, strip the headers from both surfaces.
Skill: https://anc.dev/fix/mcp-cors-preflight
Docs: https://developer.mozilla.org/en-US/docs/Glossary/Preflight_request
```

## Verify

Re-run the audit at [https://anc.dev/audit](https://anc.dev/audit) or call the `audit_website` MCP tool; the `mcp-cors-preflight` check should report `pass`.