cross domain - Why do Chrome/Safari include the Origin header in Access-Control-Request-Headers? -


this question followup why non-custom headers included in access-control-request-headers?

during cors preflight request, both chrome , safari include origin header in access-control-request-headers header. ignore header, in sense origin doesn't need in corresponding access-control-allow-headers response header. , while cors spec doesn't define origin simple header, there other headers, such user-agent, aren't defined simple headers , yet aren't included in access-control-request-headers. firefox not include origin header in access-control-request-headers.

so question is: why chrome & safari include origin header in access-control-request-headers, since has no effect? guess because both based on webkit, i'm looking answer digs deeper why behavior exists @ all.


Comments

Popular posts from this blog

c# - Send Image in Json : 400 Bad request -

javascript - addthis share facebook and google+ url -

ios - Show keyboard with UITextField in the input accessory view -