4 ms·
> For those you don't need CORS anyway CORS is needed for GET if the request needs to send headers like `Authorization`, AFAIK
by al2o3cr 8y ago
> For those you don't need CORS anyway
CORS is needed for GET if the request needs to send headers like `Authorization`, AFAIK
- lostcolony 8y agoYes. There are a few safelisted headers (and relatedly, content-types) that do not trigger a pre-flight; any GET that uses something outside of them (such as 'authorization") gets preflighted.
- mr_toad 8y agoYes, here’s a full list https://developer.mozilla.org/en-US/docs/Glossary/Forbidden_header_name https://developer.mozilla.org/en-US/docs/Glossary/Forbidden_...