cross domain - Why do Chrome/Safari include the Origin header in Access-Control-Request-Headers? -
this question followup why non-custom headers included in access-control-request-headers?
during cors preflight request, both chrome , safari include origin
header in access-control-request-headers
header. ignore header, in sense origin doesn't need in corresponding access-control-allow-headers response header. , while cors spec doesn't define origin simple header, there other headers, such user-agent
, aren't defined simple headers , yet aren't included in access-control-request-headers. firefox not include origin header in access-control-request-headers.
so question is: why chrome & safari include origin
header in access-control-request-headers
, since has no effect? guess because both based on webkit, i'm looking answer digs deeper why behavior exists @ all.
Comments
Post a Comment