Re: [whatwg/fetch] Clarification on CORS preflight fetches for TLS client certificates (#869) from Anne van Kesteren on 2021-06-03 (public-webapps-github@w3.org from June 2021)

From: Anne van Kesteren <notifications@github.com>
Date: Thu, 03 Jun 2021 05:05:57 -0700
To: whatwg/fetch <fetch@noreply.github.com>
Cc: Subscribed <subscribed@noreply.github.com>
Message-ID: <whatwg/fetch/issues/869/853817851@github.com>

I guess I'm not following then. `OPTIONS` is indeed done without credentials, but that doesn't mean that the actual request should fail if the server properly responded to the `OPTIONS` request.

And no, the confused deputy attack referenced a couple times above is about the server, not the client.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/869#issuecomment-853817851

Received on Thursday, 3 June 2021 12:06:42 UTC