Re: [whatwg/fetch] CORS should not be enforced on cross-origin requests where credentials is omit or same-origin (#787) from David Barratt on 2018-08-15 (public-webapps-github@w3.org from August 2018)

From: David Barratt <notifications@github.com>
Date: Wed, 15 Aug 2018 05:34:32 -0700
To: whatwg/fetch <fetch@noreply.github.com>
Cc: Subscribed <subscribed@noreply.github.com>
Message-ID: <whatwg/fetch/issues/787/413184123@github.com>

"We invented CORS so that Untrusted can access the contents of resources on Example (and even on Credentialed and Intranet) as long as the resource opts in."

Why does the resource need to opt-in to un-credentialed requests? That doesn't make any sense.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/787#issuecomment-413184123

Received on Wednesday, 15 August 2018 12:34:54 UTC