{
  "context": "Tests whether the response correctly diagnoses a CORS preflight failure beyond just the Allow-Origin header.",
  "type": "weighted_checklist",
  "checklist": [
    {
      "name": "Explains the preflight (OPTIONS) request",
      "description": "Explains that the browser sends an OPTIONS preflight request before the actual POST, and the server must respond to it correctly",
      "max_score": 12
    },
    {
      "name": "Identifies missing Allow-Headers",
      "description": "Points out that Content-Type: application/json triggers a preflight that requires Access-Control-Allow-Headers to include Content-Type",
      "max_score": 15
    },
    {
      "name": "Mentions Allow-Methods needed",
      "description": "Notes that Access-Control-Allow-Methods must include POST",
      "max_score": 10
    },
    {
      "name": "Server must handle OPTIONS method",
      "description": "Notes that the server must respond to the OPTIONS request with a 200/204 and the CORS headers (not just add headers to POST responses)",
      "max_score": 10
    },
    {
      "name": "No incorrect information",
      "description": "CORS mechanism explanation is technically correct",
      "max_score": 10
    }
  ]
}