Re: [whatwg/fetch] Proposal: Allow servers to take full responsibility for cross-origin access protection (#878)

Today servers express a clear wish to opt-out through `Access-Control-Allow-Origin: *`. However, that is not what it strictly means. As evidenced by the recent small change, existing applications will keep breaking when opting out is not expressed in the specification. In the as-is situation, servers need to adapt their opting out walk-around as the spec evolves regardless of their use case.

Instead of having this walk-around servers now implement, we propose that a dedicated mechanism is put in place. This mechanism then becomes part of the living specification, where browser-vendors would be _more cautious_ (never say never) to change anything on this part as it may break these applications.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/878#issuecomment-471013790