This week's reminder came courtesy of Safari.
Everything worked perfectly in Chrome and Edge. APIs responded. Infra looked solid. Deployments were green.
Safari? Blocked the API calls completely. No backend errors. No pod logs. Just blocked API calls.
The root cause wasn't the service logic or Kubernetes pods — it was CORS gaps at the API gateway level.
Things Chrome let slide, Safari wouldn't
- Missing
Access-Control-Allow-Credentials - Using
Access-Control-Allow-Origin: *with Authorization headers - Missing
Access-Control-Expose-Headers - Missing
Access-Control-Max-Age - CORS not applied to all paths or OPTIONS
- Incomplete response header definitions in IaC
Safari is strict, spec-correct, and unforgiving of shortcuts.
The takeaway: Safari should be a first-class test target, not an afterthought. Hope this saves someone a few debugging hours.