Name the scheme, host, and port that form a URL's origin, decide whether two pages are same-origin, and predict whether a script can read a cross-origin response or only send the request.

Your `fetch('https://api.example.com/data')` fires and the server answers with a normal `200`, yet the console shows a red error and your code cannot touch the body. The response arrived; the browser refused to let your script read it.

Read an OPTIONS preflight exchange and name what each Access-Control-* header does, predict whether a request is sent directly or preflighted from its method and content type, and fix a wildcard origin that breaks the moment credentials ride along.

Your `fetch('https://api.example.org/orders')` comes back blocked, so you keep adding headers to the request and it keeps failing. The one header that unblocks it lives on the response, and only the server can send it.

Predict whether a stored cookie rides a cross-site request from its SameSite value, tell the site boundary apart from the origin boundary that blocks a cross-origin read, and assemble the flags a login session versus a third-party embed each needs.

`curl -v https://app.example.com` prints one line you typed and one the browser adds without asking: a header carrying a value the server handed you on an earlier response, replayed now on its own, with no code re-sending it.

Sort each http subresource an https page loads into upgraded or blocked by whether it can modify the page, predict when an upgrade silently drops a resource, and decide which pages are secure contexts that expose powerful APIs.

You ship a dashboard over `https`, the address bar shows the closed padlock, and one `<script src="http://...">` you pasted months ago never runs. The page half-renders and the console prints one red line explaining the drop.

Trace a request as it stops at the worker's `fetch` handler, predict which response comes back (the network, a hand-filled cache, or a JavaScript string), and tell the worker's Cache Storage apart from the HTTP cache it does not obey.

You switch the browser to `Offline`, reload the notes app you shipped, and `fetch('/today.json')` still comes back `200` with today's list, no request having left the machine. Something answered in the network's place.