Tests CORS the way it actually happens: the Worker sends the request from this page's origin with your method, headers, credentials mode and body, so the browser performs any preflight itself. The report classifies the request (simple or preflighted, and why), states whether the browser accepted the response, lists the response headers JavaScript can see (only CORS-safelisted and explicitly exposed ones — Access-Control-* headers are never visible to scripts), and when the request fails runs a no-cors reachability probe to tell a CORS block from a network problem. It then lists the exact Access-Control-* headers the server needs and curl commands that reveal the preflight response. The page CSP connect-src and forbidden request headers apply as in any page.