Add client side CORS check for prefix services

[lele85]

Our server-side HTTP HEAD measurements are performed by a Lambda function, not a browser, so they never trigger CORS. However, in-browser playback technologies such as HLS (commonly implemented via hls.js) fetch media segments using cross-origin fetch/XHR requests, which do require the target server to respond with proper Access-Control-Allow-Origin headers, unlike a plain <audio>/<video> tag.

This complementary, browser-only signal is surfaced automatically, as soon as an endpoint's detail page loads, by performing a live check directly from your own browser against a prefix service's URL, resulting in either a:

• CORS OK
• CORS KO

This check is only available for prefix services. We intentionally leave enclosure URLs out of scope: anyone shipping HLS video already has to satisfy Apple's own requirements around CORS, so there's little value in re-verifying it here.

Under the hood, the check performs an HTTP HEAD request from your browser and confirms that the full redirect chain completes successfully. We don't surface the response headers themselves, since depending on the browser and the server's Access-Control-Expose-Headers configuration, they may not actually be made available to JavaScript.

[orca-security-us]

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	Infrastructure as Code	0   0   0   0	View in Orca
Passed	OSS Licenses	0   0   0   0	View in Orca
Passed	Malicious Packages	0   0   0   0	View in Orca
Passed	SAST	0   0   0   0	View in Orca
Passed	Secrets	0   0   0   0	View in Orca
Passed	Vulnerabilities	0   0   0   0	View in Orca

[roccozanni]

Nice!