'Do some browsers require the Origin header to be explicitly allowed for CORS to succeed?
Among popular CORS middleware libraries for Go is rs/cors. In its source code, above some logic that unconditionally adds Origin to the list of allowed headers, I found the following comment:
Origin is always appended as some browsers will always request for this header at preflight
🤔 I find this statement surprising... The Fetch standard (the de factor standard for the CORS protocol) states that compliant user agents set the Origin header themselves. Therefore, there should be no use for compliant user agents to require servers to explicitly list Origin in the Access-Control-Allow-Headers header.
Do some browsers actually require the Origin header to be explicitly allowed by the server for CORS to succeed? If so, what are those browsers and what is their rationale?
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|