Re: [whatwg/fetch] Clarification on CORS preflight fetches for TLS client certificates (#869)

alexiade left a comment (whatwg/fetch#869)

And if you are wondering what's the usecase... GRPC endpoint for a web application is an independent service and deployed into a separate virtuahost. It has VERY specific allowed origin header for authorized frontends in place. The mTLS lets me issue keys that expire to customers for demo purposes and ensures only people with legitimate interest can establish a TCP connection. Because without a connection... its pretty hard to exploit anything is it... And it's on a public IP. it got hit with various probes the moment it went up. Transport security is meant to protect against that ... Setting up a whole vpn/tunneling rig for just that makes no sense and is a bother people needing easy access to check the product out do not need nor want. mTLS was made for this.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/869#issuecomment-4684965103
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/fetch/issues/869/4684965103@github.com>