Replies posted by Freyja Østrem

1 Reply

C
Active
Christopher WhealyActive
asked in Developer and User Community

Setting HTTP headers for CORS policy

Does the CORS request set the request option to include browser credentials ({ credentials: "include" } for Fetch API, or request.withCredentials = true for XMLHttpRequest)? Browsers should only block CORS requests when Access-Control-Allow-Credentials: true is not present if that request option is set, which it is not by default.For security reasons, the CDF API does not use any form of browser credentials (such as cookies) for authentication, which is why we do not set that CORS header in the OPTIONS response. Because of this, the CORS request options should either have the browser credentials request option set to omit credentials, or have it be unset (using the default value).Authentication is only done with a bearer token in the Authorization header set in the request, which does not require Access-Control-Allow-Credentials: true and only requires Access-Control-Allow-Headers to include the Authorization header, which it as far as I can tell does.

8
F
Practitioner
10 months ago

Badge winners

Show all badges
Terms & ConditionsCookie Settings