Wildcard CORS requests shouldn't send credentials

iitc-project / ingress-intel-total-conversion

ingress.com/intel total conversion user script with some new features. Should allow easier extension of the intel map.

http://iitc.jonatkins.com/

ISC License

989 stars 552 forks source link

Wildcard CORS requests shouldn't send credentials #1216

Closed FesterCluck closed 7 years ago

FesterCluck commented 7 years ago

There's no reason to send to be sending credentials to openstreetmaps. Chrome will refuse to parse the response, and rightfully so. While possibly intentional, this is a great way to bleed credentials cross domain. We may want to review old browser cases to see if we were doing this, because that would be... bad.

Please consider this patch as urgent.

FesterCluck commented 7 years ago

Plugins problem. Retracted