Re: [whatwg/fetch] Proposal: Allow servers to take full responsibility for cross-origin access protection (#878)

As described in _Shortcomings of current mechanisms_ above, the problem is 1) the complexity (which is broader than the need for multiple headers; also the fact some of those headers  need to be reactive, which is harder to configure in NGIN/Apache), but mainly 2) that no such configuration is a final solution. We understand that the fetch spec is in evolution, as it should be, but this currently means that all public APIs and authenticated APIs have to keep on updating to be able to function like before. And since the solution is on the server side, Web apps have no control over breakage.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/878#issuecomment-470977826