7 ms·

Honestly that seems reasonable to me. Makes much more sense than the alternative imo.

• kreetx 3y ago
  The issue is that if you do have the client certificate, then (as sibling suggests) now you need to configure your proxy to decide on how to reply to pre-flight requests. Doable but application logic has now leaked into proxy configuration. Another workaround is to use a non-preflighted request, i.e POST with multipart for sending larger amounts of data. Yuck! Why can't I talk application/json to my cross-origin mTLS service as a normal person? :)
  • bawolff 3y ago
    But if you are using mTLS for authentication, you probably don't want random websites to connect with the certificate.
    • kreetx 3y ago
      You'll only be able to send client certificates which match the server's CA cert, and if any are found the browser will also prompt you to whether to send it (there'll also be a dropdown when there are more than one).