W3C home > Mailing lists > Public > public-webapps@w3.org > October to December 2011

[cors] JAX-RS and preflight

From: Benson Margulies <bimargulies@gmail.com>
Date: Thu, 1 Dec 2011 15:20:06 -0500
Message-ID: <CALhtWkcBG24upu_QkZyVv35OzWWLfpKD6-zKSnOHdB3e2H0VzA@mail.gmail.com>
To: public-webapps@w3.org
There's a problem with REST-ful services, as exemplified by the JAX-RS
standard, and CORS as drafted.

A JAX-RS server names a resource, in part, via the content-type of a
request. A POST with content-type of application/json names a
different resource (in as much as it selects a different method to
call) that a POST with content-type text/plain.

The problem here is that a preflight OPTIONS is defined to *not* pass
the content type unless it is simple. Thus, the service implementation
can't reliably tell what resource is under discussion.

As things are, a service would have to take a common posture for all
preflights given the URL and Accept(-*) headers, and ignoring the
content type.

Would you consider defining an Ac-Request-Content-Type header to pass
a non-simple content type on a preflight?
Received on Thursday, 1 December 2011 20:46:34 UTC

This archive was generated by hypermail 2.3.1 : Friday, 27 October 2017 07:26:37 UTC