3 ms·
Where CORS got complicated for me was adding custom request and/or response headers to a cross-origin GET request. Different browsers handles this differently.
by matharmin 8y ago
Where CORS got complicated for me was adding custom request and/or response headers to a cross-origin GET request. Different browsers handles this differently. For example, Safari would make a pre-flight request if certain request headers are sent, while Chrome would just send it. And Chrome would not make a pre-flight request, and won't populate the "Origin" request header, but will then drop "unknown" response headers (and doesn't give you any way to force a pre-flight request or Origin header). I eventually figured out you can just always respond with `Access-Control-Expose-Headers`, even though it doesn't look like a CORS request, and then Chrome will expose the headers to the JS.
- bzbarsky 8y agoThat's really odd. There are shared tests for all this stuff, and browsers should really be doing it identically. Did you happen to report bugs on this to browsers? If not, do you happen to have a link to a page that shows the behavior difference?
- matharmin 8y agoNope, never got around to debug in depth. Will do that when I have some time again.
- bzbarsky 8y agoThank you! Even just a page that shows the behavior differences, without much debugging, would be really helpful; this sort of thing is something browsers very much aim to have working identically.