3 ms·
I like this idea a lot. One thing I'm confused about, though. Does this also apply to CORS requests? If A.com sends a withCredentials CORS request to tracker.co
by CobrastanJorji 6y ago
I like this idea a lot. One thing I'm confused about, though. Does this also apply to CORS requests? If A.com sends a withCredentials CORS request to tracker.com, won't the tracker.com cookies still be sent?
- jefftk 6y agoNo, the cookies won't be sent. That would defeat the whole purpose.
- CobrastanJorji 6y agoSo this effectively eliminates the "XMLHttpRequest.withCredentials" setting? Interesting! Thanks for clarifying.
- jefftk 6y agoNo, is still has an effect. CORS operates on a per-origin basis, while privacy mitigations operate on a per-site basis. You might want withCredentials if www.site.example wanted to share cookies with forums.site.example.