#443: HTTPS and CORS
Discussions
 Comment by @annevk  Dec 4, 2019  (See Github)
  This is a bug in W3C's CORS preflight setup. A CORS preflight's response always needs to be 2xx, it cannot be a redirect. The actual response can be a redirect though.
 Comment by @ylafon  Dec 4, 2019  (See Github)
  No, apparently it could be a bug in Chrome, as pointed out by Ruben. When doing HTTP requests using curl on W3C website, it works as intended.
 Comment by @annevk  Dec 4, 2019  (See Github)
  Okay, so this is about how upgrade-insecure-requests works. However, in both Chrome and Firefox I get a response if I run that fetch() line from Ruben on www.w3.org in the console (which incorrectly hints at a relation to CORS, see https://github.com/w3c/webappsec-upgrade-insecure-requests/issues/20). Firefox has redirected set to true though, which is a bug.
 Comment by @plinss  Mar 3, 2020  (See Github)
  This appears to be an implementation bug.
OpenedDec 3, 2019 
Hello TAG!
I'm requesting a TAG review of:
Further details:
We recommend the explainer to be in Markdown. On top of the usual information expected in the explainer, it is strongly recommended to add:
You should also know that...
We'd prefer the TAG provide feedback as (please select one):
Please preview the issue and check that the links work before submitting. In particular, if anything links to a URL which requires authentication (e.g. Google document), please make sure anyone with the link can access the document.
¹ For background, see our explanation of how to write a good explainer.