[cors] JAX-RS and preflight

• From: Benson Margulies <bimargulies@gmail.com>
• Date: Thu, 1 Dec 2011 15:20:06 -0500
• To: public-webapps@w3.org
• Message-ID: <CALhtWkcBG24upu_QkZyVv35OzWWLfpKD6-zKSnOHdB3e2H0VzA@mail.gmail.com>

There's a problem with REST-ful services, as exemplified by the JAX-RS
standard, and CORS as drafted.

A JAX-RS server names a resource, in part, via the content-type of a
request. A POST with content-type of application/json names a
different resource (in as much as it selects a different method to
call) that a POST with content-type text/plain.

The problem here is that a preflight OPTIONS is defined to *not* pass
the content type unless it is simple. Thus, the service implementation
can't reliably tell what resource is under discussion.

As things are, a service would have to take a common posture for all
preflights given the URL and Accept(-*) headers, and ignoring the
content type.

Would you consider defining an Ac-Request-Content-Type header to pass
a non-simple content type on a preflight?

Received on Thursday, 1 December 2011 20:46:34 UTC