Re: [spec-reviews] "With Credentials" flag possibly inconsistent with web architecture (#76)

Explanation

The web architecture is that everything is identified by a URI.   To look up the thing, you just need the URI and then "follow your nose" (ie the specs).  But now in the fetch() spec nowadays the code has to also be provided with a withCredentials flag.  If the flag is not set, credentials are not used and presumably protected resources cannot be accessed. If the flag is set, then the CORS spec requires that access is denied even when the server from which the thing is being fetched gives a wildcard access-control-allow-origin header.  The assumption is that the developer who wrote the say XHR request knows which value to set. But in general most code is a series of libraries which have to be transparent to many things, like whether the user will use a password or a cert or cookie, and whether the server will use compression etc etc.   The library calling XHR or fetch() can't guess what value to set. The web lookup function just takes the URI. Libraries which call XHR in tern have AP
 Is which just are passed a URI.  

The HTML spec has been modified to add extra metadata to indicate a cross-origin fetch,   and XHR has xhr.withCredentials.  Every other place where URIs are used and stored etc will have to had the withCredentials flag added.  Basically the web breaks as  a function taking the URI.

The protocol should be redesigned so the flag can be calculated by fetch() with no caller input.  For example, if the CORS preview HEAD reveals *.* being used, then after that user credential could be stripped on the following fetch.

(Alternative designs include inventing two new protocol schemes, httpc: and httpsc: so as to carry the bit ... but are not optimal or serious).  

If people feel that CORS control is important then making it work for developers is important, as otherwise the tendency is to leave  a proxy open a a script's origin server to relay anything any everything without any caution or CORS, which obviously defeats the whole Same Origin Model.





---
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/spec-reviews/issues/76#issuecomment-140483668