Fire live cross-origin requests at several GNPS2 servers straight from your
browser and see which ones let this page read the response. The demo pulls a
file from an Everything-Bagel task on gnps2.org
and MS/MS peaks for a feature from the metabolomics-USI resolver
— two different servers, one page.
Requests below are sent from this page's origin:
…. A browser only lets JavaScript read a
cross-origin response when that server returned an
Access-Control-Allow-Origin header naming this origin. The
browser hides that header's value from scripts, so a fetch that
resolves and lets us read the body is itself the proof that the
server allowed us. A blocked response rejects fetch() before
any status code is seen.
Point the tester at any URL to check whether that server allows cross-origin reads from this page.
A green or amber card means that server sent CORS headers permitting this
origin. A red card means it did not — or the host was unreachable. Note the
datasetcache.gnps2.org custom-endpoint default: it usually
returns 200 to curl yet is blocked
in the browser because it sends no Access-Control-Allow-Origin —
a live example of why a working curl doesn't prove a page can
read it. Response-header tables show only the CORS-safelisted headers a
browser exposes to scripts (content-type, content-length, …), never the
allow-origin header itself. The resolver image below its MS/MS card is loaded
as an <img>, which the browser renders even when a
fetch() of the same server would be blocked — the classic
contrast between an image tag and a scripted read.