CORS explained simply

Hi,

  I find that understanding CORS is a really not easy.
It seems that what is missing is an general overview document,
that would start by explaining why the simplest possible method
won't work, in order to help the user understand then why more
complex method are needed.

For example the first thing one should start by explaining is for

 1) requests that do not require authentication
   q1: why is the origin sent at all? And why are there still restictions?
   q2: why does POSTing a url encoded form not require pre-flight? But why does POSTing other data do?

 2) On requests that do need authentication:
   q3: Why are the pre-flight requests needed at all?

I know that the answer to q1 is that some servers have access control methods
based on ip address of the client. But it is worth stating clearly the requirement
in the specs so that this can be understood.

There is also the question as to why the server needs to make a decision as to
what the client can see. But why can't it be the client? After all the user could
decide to give more rights to some JS apps than to others, and that would work too.

I am not saying that these questions don't have answers. It is just that they
would help a developer understand why CORS has taken the shape it has, and so
understanding the reaons for the decisions taken, better be able to think about it.

Henry 


Social Web Architect
http://bblfish.net/

Received on Thursday, 19 February 2015 21:29:10 UTC