Re: [whatwg/fetch] Allow servers to completely opt out of current and future CORS protection (#865) from Mark Nottingham on 2019-02-19 (public-webapps-github@w3.org from February 2019)

From: Mark Nottingham <notifications@github.com>
Date: Mon, 18 Feb 2019 17:40:41 -0800
To: whatwg/fetch <fetch@noreply.github.com>
Cc: Subscribed <subscribed@noreply.github.com>
Message-ID: <whatwg/fetch/issues/865/464944597@github.com>

FWIW - I think there's plenty of appetite for this, just not from browser vendors. 

In the past, we've talked about a `disable-cors-i-know-this-is-really-dangerous-for-my-site` flag.

I agree that origin policy (or similar) would be preferable to a header.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/865#issuecomment-464944597

Received on Tuesday, 19 February 2019 01:41:03 UTC