CORS playground
Run the preflight a browser hides from you, from any origin you choose.
Runs on the server, rate limited
A browser will not let a page choose its own Origin header, and hides the preflight from JavaScript entirely. So the exchange you most need to see when CORS fails is the one you cannot see from the page that is failing. This performs it server-side and shows both halves.