FA-7671 / WebSocket and browser transport policies / Open access

Cors preflight method matching is case sensitive · case 01

Cors preflight method matching is case sensitive.

Verified by executionVariant 1 · 4 checks per implementationDownload source bundle ↓JSON ↗

ROOT CAUSE

The faulty implementation uses `method.upper() in {a.upper() for a in allowed} or "*" in allowed` for the cors-preflight-method-matching-is-case-sensitive decision.

VERIFIED REPAIR

Apply the explicit cors-preflight-method-matching-is-case-sensitive contract, including the tested boundary and negative cases.

Unsuccessful approach: The attempted repair uses `method in allowed` and still violates a separate fixture.

Case contract

Given method, allowed, credentialed, cors preflight method matching is case sensitive. Return the protocol decision or transformed value; fields are validated and fixtures state boundary outcomes.

Why this case matters

This deterministic websocket and browser transport policies model isolates the cors-preflight-method-matching-is-case-sensitive policy at a network component boundary.

1 / The failure

Exit 1

"""Failure Map reference implementation. Python standard library only."""
import json
import ipaddress
import re
from urllib.parse import urlsplit, urljoin
N = 1
observations = []
def solve(method, allowed, credentialed):
    return method.upper() in {a.upper() for a in allowed} or "*" in allowed
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
_fixtures = ["check('fixture 1', solve('get', ['GET'], False), False)", "check('fixture 2', solve('PUT', ['*'], False), True)", "check('fixture 3', solve('PUT', ['*'], True), False)", "check('fixture 4', solve('GET', ['GET'], True), True)"]
for _line in _fixtures[N % len(_fixtures):] + _fixtures[:N % len(_fixtures)]:
    exec(_line)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)

Boundary fixture	Actual	Expected	Outcome
fixture 2	`True`	`True`	Passed
fixture 3	`True`	`False`	Failed
fixture 4	`True`	`True`	Passed
fixture 1	`True`	`False`	Failed

SHA-256 / 9b20717afcbffbd6764327c83da5d7f35d1f4341e6a69e96bb98cf7fda52a593

2 / The unsuccessful fix

Exit 1

"""Failure Map reference implementation. Python standard library only."""
import json
import ipaddress
import re
from urllib.parse import urlsplit, urljoin
N = 1
observations = []
def solve(method, allowed, credentialed):
    return method in allowed
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
_fixtures = ["check('fixture 1', solve('get', ['GET'], False), False)", "check('fixture 2', solve('PUT', ['*'], False), True)", "check('fixture 3', solve('PUT', ['*'], True), False)", "check('fixture 4', solve('GET', ['GET'], True), True)"]
for _line in _fixtures[N % len(_fixtures):] + _fixtures[:N % len(_fixtures)]:
    exec(_line)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)

Boundary fixture	Actual	Expected	Outcome
fixture 2	`False`	`True`	Failed
fixture 3	`False`	`False`	Passed
fixture 4	`True`	`True`	Passed
fixture 1	`False`	`False`	Passed

SHA-256 / aedf56a43be2e029ab1d6a43869bf5cc29eb42a6193771dc43501138f208ec63

3 / The verified repair

Exit 0

"""Failure Map reference implementation. Python standard library only."""
import json
import ipaddress
import re
from urllib.parse import urlsplit, urljoin
N = 1
observations = []
def solve(method, allowed, credentialed):
    return method in allowed or ("*" in allowed and not credentialed)
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
_fixtures = ["check('fixture 1', solve('get', ['GET'], False), False)", "check('fixture 2', solve('PUT', ['*'], False), True)", "check('fixture 3', solve('PUT', ['*'], True), False)", "check('fixture 4', solve('GET', ['GET'], True), True)"]
for _line in _fixtures[N % len(_fixtures):] + _fixtures[:N % len(_fixtures)]:
    exec(_line)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)

Boundary fixture	Actual	Expected	Outcome
fixture 2	`True`	`True`	Passed
fixture 3	`False`	`False`	Passed
fixture 4	`True`	`True`	Passed
fixture 1	`False`	`False`	Passed

SHA-256 / 1dce64648c0b20183b9f1c02fcee4b9c992a69ec505b00e44715a4a8853cc90c

Verification & scope

Bounded deterministic policy model over validated inputs; not a complete protocol stack or an interoperability claim. The five variants rotate the same explicit fixture set. This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.

Observations recorded using Python 3.12.14 at 2026-09-29T14:38:14.177592+00:00.

Case digest / fc6077c8395dd837a98f8ee36227375bf289b2d2c10517f7926428828a34fcb8