Re: [whatwg/fetch] No documentation on how a server must response to a wrong CORS-headers-request. (#1102) from Anne van Kesteren on 2020-10-21 (public-webapps-github@w3.org from October 2020)

From: Anne van Kesteren <notifications@github.com>
Date: Tue, 20 Oct 2020 22:33:23 -0700
To: whatwg/fetch <fetch@noreply.github.com>
Cc: Subscribed <subscribed@noreply.github.com>
Message-ID: <whatwg/fetch/issues/1102/713314239@github.com>

The server can use them and make decisions based on the information provided by the client, but isn't required to. We don't even require a 403, just encourage it.

I'm happy to include some more advice, but if servers just want to echo a static reply to the OPTIONS request that ought to be okay and might well be more efficient than having to validate each request. Would stipulating that validating the request and potentially replying with a 403 is up to servers help?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/1102#issuecomment-713314239

Received on Wednesday, 21 October 2020 05:33:35 UTC