Re: [cors] Redirects

2009-04-23 Thread Anne van Kesteren
On Thu, 23 Apr 2009 02:06:41 +0200, Jonas Sicking jo...@sicking.cc wrote: So there are a few design decisions we need to make: Should we treat a redirect of a preflight request, as redirecting the actual request? The answer to this may depend on which type of redirect it is. What does a 303

Re: [cors] Redirects

2009-04-23 Thread Jonas Sicking
Hi Anne, Sorry, I think I was unclear in my email. Most of the questions that are still unclear to me is how the HTTP spec intends requests to work. I.e. not what the CORS spec say that UAs should do for CORS requests, but what HTTP says should be done for various requests on a protocol level.

Re: [cors] Redirects

2009-04-23 Thread Anne van Kesteren
On Thu, 23 Apr 2009 12:35:30 +0200, Jonas Sicking jo...@sicking.cc wrote: I think this is important since we should in general try to follow the letter and spirit of the HTTP spec. I tend to agree. I've requested review of the HTTP WG in the past and mnot has just done that again to make

Re: [cors] Redirects

2009-04-23 Thread Alexey Proskuryakov
23.04.2009, в 12:54, Anne van Kesteren написал(а): I want to support redirects on simple requests (as is already done for e.g. img and form) and preflight requests, but not on actual requests. This is what the specification specifies and I believe this is what WebKit implements. Not at

Re: [cors] Redirects

2009-04-22 Thread Anne van Kesteren
On Wed, 18 Mar 2009 12:23:30 +0100, Anne van Kesteren ann...@opera.com wrote: Thinking about this some more I rather treat redirects as errors. I think that will work better as future extension point. It also is more consistent I think. They are either a point of error or are transparently

Re: [cors] Redirects

2009-03-18 Thread Anne van Kesteren
On Tue, 17 Mar 2009 21:56:52 +0100, Anne van Kesteren ann...@opera.com wrote: On Tue, 17 Mar 2009 21:50:21 +0100, Anne van Kesteren ann...@opera.com wrote: * cross-origin request with preflight, actual request If we want to follow redirects here at all we can only do it for requests that

[cors] Redirects

2009-03-17 Thread Anne van Kesteren
I took another look at redirects today. * simple cross-origin request For this case redirects can simply be followed. Some redirects will cause the request method to be changed from HEAD, GET, or POST to GET. Per HTTP that would be 303. Per implementations that would be 301, 302, and 303.

Re: [cors] Redirects

2009-03-17 Thread Anne van Kesteren
On Tue, 17 Mar 2009 21:50:21 +0100, Anne van Kesteren ann...@opera.com wrote: * cross-origin request with preflight, actual request If we want to follow redirects here at all we can only do it for requests that do not require a preflight. Therefore I'm still not quite convinced that we

Re: [cors] Redirects and preflights

2009-03-16 Thread Anne van Kesteren
On Thu, 05 Mar 2009 10:18:39 +0100, Jonas Sicking jo...@sicking.cc wrote: [...] So this is quite a common pattern on the web today, and ideally should be more common. The pattern is typically implemented using 302, but yeah... For this setup it makes a lot of sense to not redirect a

Re: [cors] Redirects and preflights

2009-03-05 Thread Jonas Sicking
What about the following scenario: 1. A page on site A initiates a DELETE request to a uri on site B 2. The UA makes a preflight OPTIONS request to the uri on site B 3. The site responds and says the original DELETE request is ok 4. The UA makes the DELETE request to site B 5. The site

[cors] Redirects and preflights

2009-03-04 Thread Jonas Sicking
Hi WebApps fans! (woot) So a few issues I've run into playing around with redirects and preflighted requests. Below are some scenarios, questions and proposed answers. First of all, what should happen in the following case: 1. A page on site A makes a DELETE request to a uri on site A (no