7 ms·
> […] the browser prevents itself from making the call. That's not strictly correct, by the way. The request is made, but the JavaScript code on Domain A is no
by 9dev 3mo ago
> […] the browser prevents itself from making the call.
That's not strictly correct, by the way. The request is made, but the JavaScript code on Domain A is not allowed to read the response. This matters when a request is destructive on its own, for example.
- eurleif 3mo agoTo go even deeper into the weeds: this is only true of "simple" requests[0]. Requests that aren't "simple" always require preflight approval. This is based on which requests a <form> or link could already create without approval; since the dawn of time, <form method="post"> could submit a potentially-destructive request, and sites needed to protect themselves against that via XSRF tokens; so CORS could allow submiting the same class of requests without preflight approval, and not introduce any new attacks. But there's no <form method="delete">, for example, so CORS would have created attacks against previously-secure sites if it had allowed DELETE requests without preflight approval. [0] https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS#simple_requests https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/COR...
- ralusek 3mo agoMy understanding was it was an OPTIONS preflight request that is made.
- 9dev 3mo agoOnly for complex requests, and even then - a naive implementation of a web application that executes actions on GET requests might do the same for a HEAD request too.