Subject: Re: Issue #356: Form-encode Expect-CT report bodies?

From: Anne van Kesteren <[email-masked]>
Date: Sat, 1 Jul 2017 07:17:07 -0700

On Sat, Jun 10, 2017 at 2:19 AM, Patrick McManus <[email-masked]> wrote:
> second, cors clearly makes some distinction between UA content and
> content-content.. request headers for example. The notion being that the UA
> can effectively make at least some decisions about what will botch things up
> compared to what arbitrary JS might do.

There is some of that (Last-Event-ID from EventSource comes to mind,
not sure there is anything else really), but generally this is no
longer true and I think we should try not to go there.

Deciding on a case-by-case basis when it's okay to violate the
same-origin policy seems rather dangerous, especially as we don't seem
to have a set of guidelines to make those kind of decisions.

-- 
https://annevankesteren.nl/