Re: [whatwg/fetch] CORS should not be enforced on cross-origin requests where credentials is omit or same-origin (#787)

It wouldn't be the first time the web has changed the status quo without unduly affecting end users.

Let me give an example:
Suppose I want to create an RSS reader web app. It would be impossible to do that, because I'd have to ask every single site owner on the web to correctly implement CORS on their server.

So basically, it's impossible to create an web app like that (even though, it's a perfect use case for a web app).

To your point about same-origin policy... why is it that credential-less cross-origin requests are subject to the same origin policy?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/787#issuecomment-413193423