- Ya
- 20 Agosti 2026, 14:55 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 088c612
`accessControlMaxAge: 100` meant browsers re-ran the preflight roughly once per visit, so every page load on the marketing site paid two extra OPTIONS round-trips — to api. for the chat bootstrap and to analytics. for the beacon — before the requests it actually wanted. Measured with Chrome against the live site. It was also overriding APIService, which sets `setMaxAge(3600)` in its own CORS config and was being silently ignored by the middleware in front of it. 7200 is Chrome's ceiling; larger values are clamped to it. This cannot loosen access — the allow-lists alongside it are what grant that — it only stops the browser re-asking a question it already holds the answer to.