4 ms·

I was running into a CORS-related issue, and was thinking of a possible solution: If it were possible to make "cookie-less" AJAX requests to things like APIs,

by rtpg 11y ago

I was running into a CORS-related issue, and was thinking of a possible solution: If it were possible to make "cookie-less" AJAX requests to things like APIs, would it be safe for those requests to bypass CORS? My impression is that the cookie sending is the main danger, and if we could opt-out, then the "use API with provided key" use-case could work independent of what the destination site wants. I don't know if there's a "spec" for CORS rules though..

toomuchtodo 11y ago
> I don't know if there's a "spec" for CORS rules though.. https://www.w3.org/TR/2014/REC-cors-20140116/ https://www.w3.org/TR/2014/REC-cors-20140116/
strommen 11y ago
FYI, Safari on iOS will never send cookies cross-domain, regardless of how you configure the server or call your XmlHttpRequest (the user can enable 3rd-party cookies in Settings, but literally nobody will ever do this): https://stackoverflow.com/questions/14206531/mobilesafari-wont-send-back-cookies-set-with-cors https://stackoverflow.com/questions/14206531/mobilesafari-wo...