Re: [whatwg/fetch] Tighten `application/x-www-form-urlencoded` CORS safe-list carveout? (Issue #1706) from Anne van Kesteren on 2023-10-01 (public-webapps-github@w3.org from October 2023)

From: Anne van Kesteren <notifications@github.com>
Date: Sat, 30 Sep 2023 22:56:27 -0700
To: whatwg/fetch <fetch@noreply.github.com>
Cc: Subscribed <subscribed@noreply.github.com>
Message-ID: <whatwg/fetch/issues/1706/1741969677@github.com>

We do, both request's mode and destination give it away. But this exception has been there since the dawn of cross-origin `XMLHttpRequest` and I strongly suspect it's used. Not sure why I didn't gave that rationale in the earlier comment, maybe it escaped me. (It was also very much intentional to allow that without preflight contrary to what OP suggests.)

(By the way, the grandfather clause is probably best avoided given its origin: https://en.wikipedia.org/wiki/Grandfather_clause.)

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/1706#issuecomment-1741969677
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/fetch/issues/1706/1741969677@github.com>

Received on Sunday, 1 October 2023 05:56:32 UTC