3 ms·
The issue is that if you do have the client certificate, then (as sibling suggests) now you need to configure your proxy to decide on how to reply to pre-flight
by kreetx 3y ago
The issue is that if you do have the client certificate, then (as sibling suggests) now you need to configure your proxy to decide on how to reply to pre-flight requests. Doable but application logic has now leaked into proxy configuration. Another workaround is to use a non-preflighted request, i.e POST with multipart for sending larger amounts of data. Yuck!
Why can't I talk application/json to my cross-origin mTLS service as a normal person? :)
- bawolff 3y agoBut if you are using mTLS for authentication, you probably don't want random websites to connect with the certificate.
- kreetx 3y agoYou'll only be able to send client certificates which match the server's CA cert, and if any are found the browser will also prompt you to whether to send it (there'll also be a dropdown when there are more than one).