Re: [whatwg/fetch] Clarification on CORS preflight fetches for TLS client certificates (#869)

> Are you sure?

Yes, we want to limit the sources of those prompts to clear and actionable user interactions (e.g. navigations). This state machine gets confused from time to time.

> Because an `OPTIONS` request is a safe HTTP verb,

In theory, yes, but a number of such features exist because “in practice” this is not the case, and servers are ill-prepared (e.g. examining the message semantics while ignoring the request method used). Part of the reason for the preflight in the first place was to make sure that the server does understand the semantics and handles appropriately, and the omission of credentials prevents against confused deputy issues.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/869#issuecomment-787479653