{"action":"opened","issue":{"url":"https://api.github.com/repos/whatwg/fetch/issues/204","labels_url":"https://api.github.com/repos/whatwg/fetch/issues/204/labels{/name}","comments_url":"https://api.github.com/repos/whatwg/fetch/issues/204/comments","events_url":"https://api.github.com/repos/whatwg/fetch/issues/204/events","html_url":"https://github.com/whatwg/fetch/issues/204","id":128191407,"number":204,"title":"Redirect on preflighted CORS requests generally impossible","user":{"login":"nschloe","id":181628,"avatar_url":"https://avatars.githubusercontent.com/u/181628?v=3","gravatar_id":"","url":"https://api.github.com/users/nschloe","html_url":"https://github.com/nschloe","followers_url":"https://api.github.com/users/nschloe/followers","following_url":"https://api.github.com/users/nschloe/following{/other_user}","gists_url":"https://api.github.com/users/nschloe/gists{/gist_id}","starred_url":"https://api.github.com/users/nschloe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nschloe/subscriptions","organizations_url":"https://api.github.com/users/nschloe/orgs","repos_url":"https://api.github.com/users/nschloe/repos","events_url":"https://api.github.com/users/nschloe/events{/privacy}","received_events_url":"https://api.github.com/users/nschloe/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-01-22T16:25:14Z","updated_at":"2016-01-22T16:25:14Z","closed_at":null,"body":"(From [the mailing list](https://lists.w3.org/Archives/Public/public-webappsec/2016Jan/0119.html).)\r\n\r\nWith the given state of the standard, it is impossible to design APIs that use redirection on authenticated resources and allow access by clients implementing the standard.\r\n\r\nThe reason for this is that redirects on preflight CORS requests are generally forbidden. [An older version of the standard](https://www.w3.org/TR/cors/#cross-origin-request-with-preflight-0) says\r\n\r\n> 7.1.5 Cross-Origin Request with Preflight\r\n> If the response has an HTTP status code that is not in the 2xx range\r\n> Apply the network error steps.\r\n\r\nI cannot find this passage in [the latest revision](https://fetch.spec.whatwg.org/), but it's perhaps been rephrased. (Am I right?)\r\n\r\nThis restriction seems too strict as it disallows valid (RESTful) use patterns.\r\n\r\nOpinions?"}}