Re: [whatwg/fetch] Tests do not always require Origin header when mode is "cors" (#871)

Has there been any movement on this?  If you're looking to CORS-enable an application, all the documentation you find online -- as well as a number of libraries that handle it for you -- say that you should base your response on the Origin request header.  If a bunch of browsers are now sending CORS requests with no Origin, how am I supposed to figure out the value to send for ACAO?  I can parse it out of the Referer, assuming that's set, but is it a good long-term solution?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/871#issuecomment-520774538