Splitting TLS and CORS into two separate checks is the most useful part of this. Two small additions for this setup: if the mock echoes the request's Origin back instead of a fixed value, also send "Vary: Origin", so a cache in between can't hand one origin's answer to another. And Access-Control-Max-Age helps while you work, but the browser keeps using the cached preflight until it expires (Chromium caps it at 2 hours, Firefox at 24), so a CORS rule you just changed can look like it didn't apply. Keep the max age short while you're still changing rules.
RequestFox
Free API tester and network monitor for Chrome and Firefox.
Splitting TLS and CORS into two separate checks is the most useful part of this. Two small additions for this setup: if the mock echoes the request's Origin back instead of a fixed value, also send "Vary: Origin", so a cache in between can't hand one origin's answer to another. And Access-Control-Max-Age helps while you work, but the browser keeps using the cached preflight until it expires (Chromium caps it at 2 hours, Firefox at 24), so a CORS rule you just changed can look like it didn't apply. Keep the max age short while you're still changing rules.