gpt4 book ai didi

http - 为什么 CORS 规范不允许重定向?

转载 作者:可可西里 更新时间:2023-11-01 15:29:46 25 4
gpt4 key购买 nike

W3C CORS spec第 2 步中明确指出:

If the response has an HTTP status code of 301, 302, 303, 307, or 308

 Apply the cache and network error steps.

我认为添加此措施是为了降低安全风险。但是,我无法找到详细说明允许重定向的安全后果的来源。


关于如何规避这个问题的问题已经被问到before .我正在寻找为什么首先将此条款包含在规范中的解释,例如以下问题:

CORS - What is the motivation behind introducing preflight requests?

Why does a cross-origin HEAD request need a preflight check?

最佳答案

来自WHATWG mailing list :

Mostly because with preflight fetches everything gets more complicated. We did leave the door open to potentially allow this at some point, provided we figure out a sane protocol, but left it out initially for simplicity.

关于http - 为什么 CORS 规范不允许重定向?,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/24135854/

25 4 0
Copyright 2021 - 2024 cfsdn All Rights Reserved 蜀ICP备2022000587号
广告合作:1813099741@qq.com 6ren.com