3 ms·
My main issue with CORS is the latency doubling introduced by preflight requests. I wish there was a more secure escape hatch for that than including things lik
by anderspitman 6y ago
My main issue with CORS is the latency doubling introduced by preflight requests. I wish there was a more secure escape hatch for that than including things like access tokens in the query parameters[0].
[0]: https://stackoverflow.com/q/61563348/943814 https://stackoverflow.com/q/61563348/943814
- Klathmon 6y agoIf you set the Access-Control-Max-Age header [1] it will at least cache the preflight response for up to 2 hours in chrome. [1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Max-Age https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Ac...
- anderspitman 6y agoThat helps, but not for the first request at each endpoint, and for my use case I have many different endpoints. I wish there was an option to cache CORS for subpaths, kind of like how you can make a cookie valid for any subpaths under a specific path.
- dysfunction 6y agoI think the usual approach is to proxy the other domain (or subdomain) to a path on your user-facing domain. E.g. if mysite.com is making requests to api.mysite.com, you would proxy api.mysite.com to mysite.com/api.
- anderspitman 6y agoI'm building a pure backend service that I want app developers to be able to consume. If they have a static app, they shouldn't be required to run their own backend just to get around CORS. At the very least you're adding an extra hop, which is going to increase latency. That said, it would be cool if static hosting services like S3 offered CORS proxies for uses like this. I wonder if that's a thing.