3 ms·

This is why we can make GET and POST requests without an OPTIONS preflight... Apparently, since developers should already have been protecting against cross-or

This is why we can make GET and POST requests without an OPTIONS preflight... Apparently, since developers should already have been protecting against cross-origin requests on GET and POST via other means (CSRF tokens), there was no need for the additional preflight protection. They only added preflights to requests that browsers couldn't make previously. Source: https://stackoverflow.com/a/39736697/114855 https://stackoverflow.com/a/39736697/114855

Raqbit 5y ago
This is also the reason you can still POST text/plain to random TCP servers on the user's local network, without pre-flight check.
- dividuum 5y ago
  That’ll be gone soon: https://web.dev/cors-rfc1918-feedback/ https://web.dev/cors-rfc1918-feedback/
matsemann 5y ago
I'd rather deal with stateless CORS than having to muck around with CSRF again, though.