Re: [whatwg/fetch] Clarification on CORS preflight fetches for TLS client certificates (#869)

> No, they would behave like WebSockets do: if you’ve previously selected credentials for the host (e.g. navigation), then they’re available to be reused. If the user has not already provided credentials-that-require-interaction, however, they won’t be sent/the fetch would raise it as a network error (e.g. as requests through proxies can also do)

Sorry, what I meant to ask was: will non-preflighted request go away entirely for cross-origin APIs? since one never navigates to them, but just use as a target for fetch requests.

And then perhaps another bug: currently there is the odd situation that when I run a fetch with `GET` on a certificate-required site then this succeeds (prompting me also for a certificate when it's the first time I touch that cross-origin API). And then if I follow that up with a `PUT` (which requires a preflight), then this fails -- although this was an origin *I already had interacted with and provided a certificate for*.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/869#issuecomment-787524103