FA-7686 / WebSocket and browser transport policies / Open access
Cors preflight cache key includes origin and method · case 01
Cors preflight cache key includes origin and method.
ROOT CAUSE
The faulty implementation uses `origin` for the cors-preflight-cache-key-includes-origin-and-method decision.
VERIFIED REPAIR
Apply the explicit cors-preflight-cache-key-includes-origin-and-method contract, including the tested boundary and negative cases.
Unsuccessful approach: The attempted repair uses `method` and still violates a separate fixture.
Case contract
Bounded offline decision model: cors preflight cache key includes origin and method. Inputs are already validated protocol fields; the explicit fixtures define the supported policy, not a complete protocol implementation.
Why this case matters
This deterministic websocket and browser transport policies model isolates the cors-preflight-cache-key-includes-origin-and-method policy at a network component boundary.
1 / The failure
Exit 1"""Failure Map reference implementation. Python standard library only."""
import json
import ipaddress
import re
from urllib.parse import urlsplit, urljoin
N = 1
observations = []
def solve(origin, method):
return origin
def check(label, actual, expected):
observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
_fixtures = ["check('fixture 1', solve('https://a', 'PUT'), ('https://a', 'PUT'))", "check('fixture 2', solve('https://b', 'PUT'), ('https://b', 'PUT'))", "check('fixture 3', solve('https://a', 'DELETE'), ('https://a', 'DELETE'))", "check('fixture 4', solve('null', 'GET'), ('null', 'GET'))"]
for _line in _fixtures[N % len(_fixtures):] + _fixtures[:N % len(_fixtures)]:
exec(_line)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
| Boundary fixture | Actual | Expected | Outcome |
|---|---|---|---|
| fixture 2 | https://b | ['https://b', 'PUT'] | Failed |
| fixture 3 | https://a | ['https://a', 'DELETE'] | Failed |
| fixture 4 | null | ['null', 'GET'] | Failed |
| fixture 1 | https://a | ['https://a', 'PUT'] | Failed |
SHA-256 / 86ac9ead290379fe160234d71d3395a44a3b36cc12ce003e89d5aca22e14d2b7
2 / The unsuccessful fix
Exit 1"""Failure Map reference implementation. Python standard library only."""
import json
import ipaddress
import re
from urllib.parse import urlsplit, urljoin
N = 1
observations = []
def solve(origin, method):
return method
def check(label, actual, expected):
observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
_fixtures = ["check('fixture 1', solve('https://a', 'PUT'), ('https://a', 'PUT'))", "check('fixture 2', solve('https://b', 'PUT'), ('https://b', 'PUT'))", "check('fixture 3', solve('https://a', 'DELETE'), ('https://a', 'DELETE'))", "check('fixture 4', solve('null', 'GET'), ('null', 'GET'))"]
for _line in _fixtures[N % len(_fixtures):] + _fixtures[:N % len(_fixtures)]:
exec(_line)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
| Boundary fixture | Actual | Expected | Outcome |
|---|---|---|---|
| fixture 2 | PUT | ['https://b', 'PUT'] | Failed |
| fixture 3 | DELETE | ['https://a', 'DELETE'] | Failed |
| fixture 4 | GET | ['null', 'GET'] | Failed |
| fixture 1 | PUT | ['https://a', 'PUT'] | Failed |
SHA-256 / 79b690478d955bcb20d92dfb39cacd78f8b406c7b5db0cdec6c7ad51ca2d2b23
3 / The verified repair
Exit 0"""Failure Map reference implementation. Python standard library only."""
import json
import ipaddress
import re
from urllib.parse import urlsplit, urljoin
N = 1
observations = []
def solve(origin, method):
return (origin,method)
def check(label, actual, expected):
observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
_fixtures = ["check('fixture 1', solve('https://a', 'PUT'), ('https://a', 'PUT'))", "check('fixture 2', solve('https://b', 'PUT'), ('https://b', 'PUT'))", "check('fixture 3', solve('https://a', 'DELETE'), ('https://a', 'DELETE'))", "check('fixture 4', solve('null', 'GET'), ('null', 'GET'))"]
for _line in _fixtures[N % len(_fixtures):] + _fixtures[:N % len(_fixtures)]:
exec(_line)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
| Boundary fixture | Actual | Expected | Outcome |
|---|---|---|---|
| fixture 2 | ['https://b', 'PUT'] | ['https://b', 'PUT'] | Passed |
| fixture 3 | ['https://a', 'DELETE'] | ['https://a', 'DELETE'] | Passed |
| fixture 4 | ['null', 'GET'] | ['null', 'GET'] | Passed |
| fixture 1 | ['https://a', 'PUT'] | ['https://a', 'PUT'] | Passed |
SHA-256 / e521bfa38bd01c8180dce31f551178b9f304bc0ab127b94c6e559b6a0dd09f98
Verification & scope
Bounded deterministic policy model over validated inputs; not a complete protocol stack or an interoperability claim. The five variants rotate the same explicit fixture set. This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.
Observations recorded using Python 3.12.14 at 2026-09-29T14:38:14.280107+00:00.
Case digest / 9488863a72d394146c243419060d6d051997f925084f64c0626bc64e604f6f01