3 ms·
Why not just include the Origin on all cross-origin requests? Then the server could deny/allow it without the need for preflight.
by denormalfloat 8y ago
Why not just include the Origin on all cross-origin requests? Then the server could deny/allow it without the need for preflight.
- jraph 8y agoI would be concerned about the privacy implication of it. Imagine if the browser sent the origin to widely used CDNs, or to Google Fonts, and that people didn't actually block Google domains on their browsers. Also, this would not be secure by default, because you would have to change the default behavior of the server to block cross origin requests.
- kijin 8y agoBrowsers already send the referer header on all those CDN requests, provided that the CDN is loaded over https. If anything, the origin contains less information.