Hacker News Reader

My main issue with CORS is the latency doubling introduced by preflight requests. I wish there was a more secure escape hatch for that than including things like access tokens in the query parameters[0].

[0]: https://stackoverflow.com/q/61563348/943814

View on HN

If you set the Access-Control-Max-Age header [1] it will at least cache the preflight response for up to 2 hours in chrome.

[1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Ac...

That helps, but not for the first request at each endpoint, and for my use case I have many different endpoints. I wish there was an option to cache CORS for subpaths, kind of like how you can make a cookie valid for any subpaths under a specific path.

I think the usual approach is to proxy the other domain (or subdomain) to a path on your user-facing domain. E.g. if mysite.com is making requests to api.mysite.com, you would proxy api.mysite.com to mysite.com/api.

I'm building a pure backend service that I want app developers to be able to consume. If they have a static app, they shouldn't be required to run their own backend just to get around CORS. At the very least you're adding an extra hop, which is going to increase latency.

That said, it would be cool if static hosting services like S3 offered CORS proxies for uses like this. I wonder if that's a thing.

Reply on news.ycombinator.com