Hacker News Reader

It seems silly to me too but re reading https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Or...

“ There are some exceptions to the above rules; for example if a cross-origin GET or HEAD request is made in no-cors mode the Origin header will not be added.”

View on HN

That's an interesting find thanks. I was not aware of no-cors mode.

It seems though that a browser would not allow 'non-simple' headers in no-cors mode[0].

Authorization headers for example would not be allowed (if i'm reading correctly). So any API using that header would not be affected by this issue right?

[0] https://developer.mozilla.org/en-US/docs/Web/API/Request/mod...

Reply on news.ycombinator.com