3 ms·
Curious what use cases you have for disabling CORS? Is it for 3rd party domains and APIs or response that you control? Either way, controlling it in browser do
by paraditedc 8y ago
Curious what use cases you have for disabling CORS?
Is it for 3rd party domains and APIs or response that you control? Either way, controlling it in browser doesn't sound like the right way.
- reitzensteinm 8y agoFor testing a client side app in development locally against a remote API, disabling cors is really handy. I have localhost.com in my hosts file and a local web server to run around it, but it's still really frustrating not being able to turn it off entirely.
- paraditedc 8y agoObviously I don't have context on your work, but in general, do you have control over remote API? If yes, you can setup different environments (dev, staging, production) and set CORS accordingly for each of them. If no, how is it working in production?
- reitzensteinm 8y agoI develop browser based video games that talk to a central API that I control. I mostly have the setup you describe, and most development happens against a CORS-free staging server. But it's often necessary to build a local prod version that is identical to the live version for debugging or analysis, that plays against real players and reads/writes to the same data store. It's an edge case, and in the past when I've done web development simply turning off CORS on staging has trivially solved any issues. But it does feel a bit like the developers of the browsers have chosen not to include the feature in a "we're smarter than you, trust us, you don't want this" kind of way. For the most part, they're probably right.
- paraditedc 8y agoI see. Just a wild idea that I haven't tried yet: Would it work if you configure your etc/hosts to point production domain to localhost and open the production domain in the browser? I'm gonna try this when I get free time.