[Bug 28117] Clarify timeout in case Preflighted CORS requests

https://www.w3.org/Bugs/Public/show_bug.cgi?id=28117

--- Comment #2 from Naren <naren@vimeo.com> ---
(In reply to Anne from comment #1)
> It seems what browsers are doing here does violate the specification as
> written. I wonder if a redirect resets the timeout as well...

You guessed it right. Redirect does reset the timeout.

> 
> On a different note, could you perhaps indicate whether
> https://lists.w3.org/Archives/Public/public-webapps/2015JanMar/thread.
> html#msg646 would be of any help? (Caching of CORS preflights for an entire
> origin when no credentials are involved.) It's pretty hard to get feedback
> from users of CORS.


Caching of CORS preflight even for a single resource will improve performance
by a great deal. Some of the use cases are posting data to a log server or
sending resumable /chunked uploads to say Google cloud storage or Amazon S3. 

Your proposal on caching for entire origin is a great idea. But I have to agree
with Brad
(https://lists.w3.org/Archives/Public/public-webapps/2015JanMar/0650.html)
especially this part:
On disadvantages of headers:
1) Individual resources declaring policy for an entire origin can be
problematic and difficult to manage.

I will give some more thought and comment on your CORS performance thread.

-- 
You are receiving this mail because:
You are the QA Contact for the bug.

Received on Sunday, 1 March 2015 19:35:58 UTC