search

whatwg / fetch

Fetch Standard
https://fetch.spec.whatwg.org/
Other
2.12k stars 332 forks source link

Add Range to no-cors safelisted headers #1767

Open joeyparrish opened 3 months ago

joeyparrish commented 3 months ago

What is the issue with the Fetch Standard?

Range requests are critical in media streaming applications, and I believe they should be safe for no-cors mode. I would like them to be added to the list of no-cors safelisted headers: https://fetch.spec.whatwg.org/#no-cors-safelisted-request-header-name

See conversation in https://github.com/whatwg/fetch/issues/1310.

joeyparrish commented 3 months ago

Also, much gratitude to @annevk for patiently explaining things to us and for filing https://github.com/mdn/content/issues/35488

annevk commented 3 months ago

Every time we have expanded what no-cors can do we have regretted it. There's also a general policy that new features need to use CORS. This idea has the backing of Chrome's security team? I'm very much opposed to this.