- From: Dominic Farolino <notifications@github.com>
- Date: Tue, 26 Sep 2023 12:41:16 -0700
- To: whatwg/fetch <fetch@noreply.github.com>
- Cc: Subscribed <subscribed@noreply.github.com>
Received on Tuesday, 26 September 2023 19:41:23 UTC
> to remove the arguably strange loophole that allows Fetch to send POST requests without a preflight because that had already been possible through form#method=POST > Here, we'll add a new case that sends authenticated cross-site POSTs, which might make locking down this pattern harder. This is true. And separately, note that the FedCM ID assertion request [does not trigger preflights](https://github.com/fedidcg/FedCM/issues/320#issuecomment-1302577496) by virtue of it happening to use the `application/x-www-form-urlencoded` request content type, thus using the "loophole" you mentioned earlier. In any case, thanks for the detailed response @arturjanc! -- Reply to this email directly or view it on GitHub: https://github.com/whatwg/fetch/issues/1637#issuecomment-1736178479 You are receiving this because you are subscribed to this thread. Message ID: <whatwg/fetch/issues/1637/1736178479@github.com>
Received on Tuesday, 26 September 2023 19:41:23 UTC