Re: XHR without user credentials

On Mon, Jun 8, 2009 at 2:17 PM, Anne van Kesteren <annevk@opera.com> wrote:

> > We already have a feature to do a request without credentials. Set the
> > withCredentials flag to false. (If you meant something else that was not
> > clear from the context, at least to me.)
>
> Though saying that I realize this is currently a strictly cross-origin
> feature. I suppose we can change that but having the defaults be different
> is somewhat awkward.
>

Good. Thanks for considering this extension. It is indeed important to
suppress presentation of credentials even for same origin requests.

When the withCredentials flag is set to false, does it also issue an
"Origin: null" header? If not, then -- given the recommended server behavior
-- this flag isn't doing its job, since an identified origin header is still
a form of credential. As mentioned earlier, for credential-free same origin
requests, it would be adequate either to say "Origin: null" or to leave the
Origin header absent.

-- 
   Cheers,
   --MarkM