[whatwg/fetch] CORS should not be enforced on cross-origin requests where credentials is omit or same-origin (#787)

Native apps are able to make a cross-origin, credential-less requests without the need of the CORS header. Web Apps should have the ability to make credential-less requests cross-origin without requiring the origin to state that the request is allowed. Credential-less requests pose no threat to the requested server. 

Without this feature, it is more likely that a server-administrator will unknowingly add `Access-Control-Allow-Origin: *` to ALL requests (even credentialed requests), thereby creating a security vulnerability where there wasn't one before. The browser should do all of this for everyone and there isn't a good reason why it shouldn't.

Browser Bug Reports:
Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=1483250
Chromium: https://bugs.chromium.org/p/chromium/issues/detail?id=874079

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/787