Re: [whatwg/fetch] CORS should not be enforced on cross-origin requests where credentials is omit or same-origin (#787)

I see what @davidbarratt is saying though. If it's a publicly accessible resource that can be accessed through a server-side language without credentials or any other restrictions then why is the policy such that it prevents access to these same, fully publicly available resources, through ajax calls? I feel this is more of an issue that should be opened up for discussion. Per the policy as it stands right now it's not a bug but a discussion about if the policy should be updated might be a fair use of time.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/787#issuecomment-413233364