RequestFox

Splitting TLS and CORS into two separate checks is the most useful part of this. Two small additions for this setup: if the mock echoes the request's Origin back instead of a fixed value, also send "Vary: Origin", so a cache in between can't hand one origin's answer to another. And Access-Control-Max-Age helps while you work, but the browser keeps using the cached preflight until it expires (Chromium caps it at 2 hours, Firefox at 24), so a CORS rule you just changed can look like it didn't apply. Keep the max age short while you're still changing rules.

Great framing. GraphQL is a good example of exactly this: with the usual application/json responses, many servers answer 200 even when the query failed, and the real result is an "errors" array next to (or instead of) "data". Partial success is allowed too, so one response can carry some fields and an error for others. A habit that helps: assert that "errors" is absent, or exactly what you expected, before you look at the data. Will a later part of the series cover GraphQL or JSON-RPC, where the status code says even less?