Re: [whatwg/fetch] Clarification on CORS preflight fetches for TLS client certificates (#869)

> I guess I'm not following then. `OPTIONS` is indeed done without credentials, but that doesn't mean that the actual request should fail if the server properly responded to the `OPTIONS` request.

"properly responded" in this context means dropping the certificate requirement and making them optional. Is that really *more* secure?

@eseglem In REST `OPTIONS` is as safe as a `GET` or `HEAD`, so why it they specifically forbid a certificate prompt for `OPTIONS` it isn't really clear.


-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/869#issuecomment-855435074