4 ms·

I'd be happy to be corrected on this, but here's what I understand: While fetch doesn't preflight for GET, it does require an Access-Control-Allow-Origin heade

by pfraze 8y ago

I'd be happy to be corrected on this, but here's what I understand: While fetch doesn't preflight for GET, it does require an Access-Control-Allow-Origin header. You can specify `no-cors` in the mode to circumvent this, but then you cant access the response body (https://developer.mozilla.org/en-US/docs/Web/API/Request/mode https://developer.mozilla.org/en-US/docs/Web/API/Request/mod...)

panarky 8y ago
Here's an example using your own site. Open the console in an empty Chrome window and paste this: fetch('https://pfrazee.hashbase.io/feed.xml') .then(response => response.text()) .then(str => console.log(str)) You'll get your RSS feed, no CORS tricks required.
- pfraze 8y ago
  My site has the Access-Control-Allow-Origin:* header set. Try the same thing on the Beaker site in the devtools for https://example.com https://example.com. fetch('https://beakerbrowser.com/dat.json') .then(response => response.text()) .then(str => console.log(str)) It should fail
  - bhritchie 8y ago
    It is failing for me because of the content security policy, which is a different thing.
    - pfraze 8y ago
      That's the case on HN. Example.com doesnt have CSPs setup so it's CORS that causes the issue.