#443: HTTPS and CORS

Visit on Github.

Opened Dec 3, 2019

Hello TAG!

I'm requesting a TAG review of:

  • Name: Issue with HTTPS redirects and CORS raised on mailing list
  • Specification URL: https://www.w3.org/mid/6324B8C3-2039-466A-9489-C1B5D05E1C98@w3.org
  • Explainer (containing user needs and example code)¹: n/a
  • GitHub issues (if you prefer feedback filed there): n/a
  • Tests: n/a
  • Primary contacts (and their relationship to the specification): @timbl

Further details:

We recommend the explainer to be in Markdown. On top of the usual information expected in the explainer, it is strongly recommended to add:

  • Links to major pieces of multi-stakeholder review or discussion of this specification:
  • Links to major unresolved issues or opposition with this specification:

You should also know that...

We'd prefer the TAG provide feedback as (please select one):

  • open issues in our GitHub repo for each point of feedback
  • open a single issue in our GitHub repo for the entire review
  • leave review feedback as a comment in this issue and @-notify [github usernames]

Please preview the issue and check that the links work before submitting. In particular, if anything links to a URL which requires authentication (e.g. Google document), please make sure anyone with the link can access the document.

¹ For background, see our explanation of how to write a good explainer.

Discussions

Comment by @annevk Dec 4, 2019 (See Github)

This is a bug in W3C's CORS preflight setup. A CORS preflight's response always needs to be 2xx, it cannot be a redirect. The actual response can be a redirect though.

Comment by @ylafon Dec 4, 2019 (See Github)

No, apparently it could be a bug in Chrome, as pointed out by Ruben. When doing HTTP requests using curl on W3C website, it works as intended.

Comment by @annevk Dec 4, 2019 (See Github)

Okay, so this is about how upgrade-insecure-requests works. However, in both Chrome and Firefox I get a response if I run that fetch() line from Ruben on www.w3.org in the console (which incorrectly hints at a relation to CORS, see https://github.com/w3c/webappsec-upgrade-insecure-requests/issues/20). Firefox has redirected set to true though, which is a bug.

Comment by @plinss Mar 3, 2020 (See Github)

This appears to be an implementation bug.