Status codes and headers from the client edge
A CDN misconfiguration often surfaces as 403 to browsers but 200 to datacenter curl. Running the check from your own laptop reproduces the user-visible status and Server/Timing headers together.
Reading common statuses
200 means OK for GET; 204 is success without body. 301/302 relocate resources—verify Location targets HTTPS. 401 and 403 differ: missing auth versus forbidden despite credentials.
CORS as a diagnostic signal
A network failure versus CORS failure tells different stories. If OPTIONS preflight fails, API gateways may need allowed methods or headers updated even when Postman from your desktop works.