3 ms·
It seems silly to me too but re reading https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin https://developer.mozilla.org/en-US/docs/Web/HTTP/Heade
by taf2 5y ago
It seems silly to me too but re reading https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Or...
“ There are some exceptions to the above rules; for example if a cross-origin GET or HEAD request is made in no-cors mode the Origin header will not be added.”
- elken 5y agoThat's an interesting find thanks. I was not aware of no-cors mode. It seems though that a browser would not allow 'non-simple' headers in no-cors mode[0]. Authorization headers for example would not be allowed (if i'm reading correctly). So any API using that header would not be affected by this issue right? [0] https://developer.mozilla.org/en-US/docs/Web/API/Request/mode#value https://developer.mozilla.org/en-US/docs/Web/API/Request/mod...