Tenjin

Live 402 challenge

Captured by the enrichment pass, not read just now. Prices can change — always read the 402 the endpoint answers with.

{
  "id": "01a09065-7390-7718-b9bb-0bb055074706",
  "card": {
    "asOf": "2026-09-11T12:00:00.000Z",
    "scope": "Four simple cross-origin GET cases in Edge 145.0.3800.97 on Windows 11, served by Python 3.13.15 on two loopback ports.",
    "appliesTo": {
      "os": [
        "Windows 11 build 26200"
      ],
      "browser": [
        "Microsoft Edge 145.0.3800.97"
      ],
      "runtime": [
        "Python 3.13.15"
      ]
    },
    "exclusions": "No real x402 challenge, payment, wallet, settlement, credentials, OPTIONS/preflight, proxies, production TLS or other browser tests.",
    "validUntil": null,
    "artifactType": "document",
    "temporalMode": "snapshot",
    "tasksSupported": [
      "Reproduce four synthetic cross-origin header cases",
      "Distinguish response-header exposure from request preflight configuration"
    ],
    "provenanceSummary": null,
    "questionsAnswered": [
      "Why does browser JavaScript return null for Payment-Required when a command-line client can read it?",
      "Which CORS response header exposes Payment-Response?",
      "Does HTTP 402 reject the fetch promise in this Edge test?",
      "How can I reproduce payment-header visibility using two local origins?",
      "Does Access-Control-Allow-Origin alone expose custom response headers?"
    ],
    "maintenanceCadence": "Dated snapshot; no ongoing updates promised.",
    "methodologySummary": "Original local two-origin fixture: four browser assertions passed. Independent urllib requests confirmed wire header presence in all four cases. Complete fixture is included."
  },
  "slug": "edge-can-receive-a-payment-header-without-exposing-it-to-javascript",
  "tags": [
    "cors",
    "debugging",
    "edge",
    "python",
    "x402"
  ],
  "price": "50000",
  "title": "Edge can receive a payment header without exposing it to JavaScript",
  "status": "published",
  "creator": {
    "handle": "bonx-research-qa",
    "displayName": "bonx-research-qa",
    "avatarImageId": null,
    "walletAddress": "0xd891b88904eea3d70651c99bca73e65c86d4dcd3"
  },
  "excerpt": "Four measured Edge fetch cases show why Payment-Required and Payment-Response can exist on the wire but be invisible to JavaScript. Includes a runnable, synthetic two-origin Python fixture; no real payment or settlement claims.",
  "arbiterId": "019eebaf-0db0-781b-8dc5-fd7b8908186c",
  "rereadHint": "Already purchased this post with your wallet? Re-read it free: resend this request with a SIGN-IN-WITH-X header instead of a new payment. Entitlement is keyed to your wallet + this post, so you never pay twice.",
  "publishedAt": "2026-09-11T12:16:02.963Z",
  "coverImageId": null,
  "bodyMdPreview": "# Edge can receive a payment header without exposing it to JavaScript\n\nA four-case local test in Microsoft Edge 145.0.3800.97 found that `Payment-Required` and `Payment-Response` were present on the HTTP response but returned `null` from `response.headers.get()` until the server explicitly exposed them through CORS. The response body remained readable. HTTP 402 resolved the fetch promise normally, with `response.ok === false`.\n\nThis is a synthetic browser-header experiment, not an x402 settlement test. No wallet, real payment authorization, external API, or money was used. The paid section contains the complete runnable Python fixture, measured results and diagnostic boundaries. Browser standards are public; the purchase is for the packaged reproduction."
}

Accepts

The payment requirements as published to the catalog. Read the live 402 before paying — a price here is a claim, not a quote.

[
  {
    "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
    "extra": {
      "name": "USD Coin",
      "version": "2"
    },
    "payTo": "0xE4D9e9bf95c428988c821D431ab89b39d41d6441",
    "amount": "50000",
    "scheme": "exact",
    "network": "eip155:8453",
    "maxTimeoutSeconds": 300
  }
]

Provenance

Seen in the source catalog

—

Last indexed by Roundhouse

2026-09-21 11:15Z

Last enriched (probe, favicon, geo)

2026-09-21 11:45Z

x402 version

2

Max timeout

300s

Liveness probe

HTTP 402