Re: [whatwg/fetch] Tighten `application/x-www-form-urlencoded` CORS safe-list carveout? (Issue #1706)

Correct. The history is that we added preflights for cross-origin requests you could not already make. I.e., everything you could already do with `<form>` was not intended to be protected. Inadvertently we did widen the number of requests you could make without preflight a little bit due to the flexibility of `XMLHttpRequest` versus `<form>` and as a result some of that has been tightened over the years to the extent deemed necessary by the security teams involved.

To add, I think it is okay when other specifications use the `application/x-www-form-url-encoded` value and follow the rules of the format. If they start sending JSON with that type it would be wise to rein it in.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/1706#issuecomment-2285633876
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/fetch/issues/1706/2285633876@github.com>