Blog
Fly.io global edge: CORS, anycast networking, and pinning API regions for latency-sensitive SPAs
Machines close to users reduce RTT but your API must still emit correct Vary and CORS headers at every POP.
1 min read
fly-ioedgecors
IPv6 and HTTP/3
QUIC handshakes differ from TCP—retest CORS after enabling HTTP/3 on the proxy.
Document which regions host stateful sessions to prevent surprise cross-region OPTIONS.
Private networking
6PN traffic between machines bypasses public CORS entirely—keep browser calls on public listeners only.
WireGuard tunnels for developers should not reuse production CORS policies.