Blog
Distributed tracing across CORS boundaries: what to propagate and what to redact
traceparent belongs in server-to-server hops; browsers should not leak internal IDs through CORS-exposed headers.
1 min read
observabilitytracingcors
Header policy
Expose only stable, non-sensitive headers to JavaScript; keep internal routing tokens server-side.
Align Access-Control-Allow-Headers with the minimal set your SPA truly sends.
Dashboards
Chart preflight ratio separately from API latency—spikes often indicate misconfigured clients.
Alert when OPTIONS error rate exceeds SLO during deploy windows.