cors statt no-cors

[xdoo]

Es wurde bei den fetch Aufrufen die Methode die Request Methode von cors auf no-cors umgestellt. Das führt zu den Problemen, die in den Tickets #149, #150 und #153 beschrieben sind. Die Stellen die zu ändern sind:

https://github.com/xdoo/lhm_animad_admin_html5/blob/7c122a2130be07b73196a7a539c26ed4c3275512/src/behaviors/animad-form-behavior.html#L137-L142

und

https://github.com/xdoo/lhm_animad_admin_html5/blob/7c122a2130be07b73196a7a539c26ed4c3275512/src/behaviors/animad-form-behavior.html#L192-L198

Aktuell brauchen wir cors. Ich denke mittelfristig werden wir auf same-origin umstellen wollen.

MDN Web Docs sagt dazu:

• same-origin — If a request is made to another origin with this mode set, the result is simply an error. You could use this to ensure that a request is always being made to your origin.
• no-cors — Prevents the method from being anything other than HEAD, GET or POST, and the headers from being anything other than simple headers. If any ServiceWorkers intercept these requests, they may not add or override any headers except for those that are simple headers. In addition, JavaScript may not access any properties of the resulting Response. This ensures that ServiceWorkers do not affect the semantics of the Web and prevents security and privacy issues arising from leaking data across domains.
• cors — Allows cross-origin requests, for example to access various APIs offered by 3rd party vendors. These are expected to adhere to the CORS protocol. Only a limited set of headers are exposed in the Response, but the body is readable.
• navigate — A mode for supporting navigation. The navigate value is intended to be used only by HTML navigation. A navigate request is created only while navigating between documents.

Rein gekommen ist das mit diesem commit: d102725bc62d03470586c97a0c606f9187937dc6

@rowe42 ich weise dir das Ticket mal zu :)

[rowe42]

Warum brauchen wir cors? Wir sollten nur genau eine Domain aufrufen, und zwar die vom API-Gateway.

[rowe42]

OK, habe wieder zu no-cors geändert, damit die mockables noch funktionieren.