W3C home > Mailing lists > Public > public-webapps@w3.org > July to September 2010

Re: [CORS] HTTP error codes in preflight response

From: Nathan <nathan@webr3.org>
Date: Tue, 21 Sep 2010 10:16:11 +0100
Message-ID: <4C9877DB.8030306@webr3.org>
To: Anne van Kesteren <annevk@opera.com>
CC: Webapps WG <public-webapps@w3.org>, Jonas Sicking <jonas@sicking.cc>
Anne van Kesteren wrote:
> On Tue, 21 Sep 2010 02:05:10 +0200, Jonas Sicking <jonas@sicking.cc> wrote:
>> CORS was recently clarified to say that error responses, such as
>> 4xx/5xx responses, should not abort the various algorithms but instead
>> such a response should be forwarded to, for example, the
>> XMLHttpRequest implementation.
>>
>> However it seems somewhat strange to me to do this with responses to
>> the preflight OPTIONS request. If a OPTIONS request results in a 404,
>> then it seems to me that the request can not be considered successful,
>> and that access to place the "real" request should not be granted.
>> Otherwise we are essentially ignoring the status code and not exposing
>> it anywhere, which seems strange.
> 
> So preflight requests should only succeed if the status code of the 
> response is 200, correct? All other status codes mean failure? (Not 
> counting 1xx here, as they are transport codes, not response codes.)

does the response to a pre-flight have a message body? if not would 204 
No Content be suited for "success" and 4xx/5xx for failure.

How are 3xx being handled, if the response is a 3xx then does it still 
require preflight & additional request just to then repeat on another URL?

Best,

Nathan
Received on Tuesday, 21 September 2010 09:17:05 GMT

This archive was generated by hypermail 2.3.1 : Tuesday, 26 March 2013 18:49:40 GMT