#443: HTTPS and CORS
Discussions
Comment by @annevk Dec 4, 2019 (See Github)
This is a bug in W3C's CORS preflight setup. A CORS preflight's response always needs to be 2xx, it cannot be a redirect. The actual response can be a redirect though.
Comment by @ylafon Dec 4, 2019 (See Github)
No, apparently it could be a bug in Chrome, as pointed out by Ruben. When doing HTTP requests using curl on W3C website, it works as intended.
Comment by @annevk Dec 4, 2019 (See Github)
Okay, so this is about how upgrade-insecure-requests
works. However, in both Chrome and Firefox I get a response if I run that fetch()
line from Ruben on www.w3.org in the console (which incorrectly hints at a relation to CORS, see https://github.com/w3c/webappsec-upgrade-insecure-requests/issues/20). Firefox has redirected set to true though, which is a bug.
Comment by @plinss Mar 3, 2020 (See Github)
This appears to be an implementation bug.
OpenedDec 3, 2019
Hello TAG!
I'm requesting a TAG review of:
Further details:
We recommend the explainer to be in Markdown. On top of the usual information expected in the explainer, it is strongly recommended to add:
You should also know that...
We'd prefer the TAG provide feedback as (please select one):
Please preview the issue and check that the links work before submitting. In particular, if anything links to a URL which requires authentication (e.g. Google document), please make sure anyone with the link can access the document.
¹ For background, see our explanation of how to write a good explainer.