{"action":"created","issue":{"url":"https://api.github.com/repos/whatwg/fetch/issues/326","repository_url":"https://api.github.com/repos/whatwg/fetch","labels_url":"https://api.github.com/repos/whatwg/fetch/issues/326/labels{/name}","comments_url":"https://api.github.com/repos/whatwg/fetch/issues/326/comments","events_url":"https://api.github.com/repos/whatwg/fetch/issues/326/events","html_url":"https://github.com/whatwg/fetch/issues/326","id":161783780,"number":326,"title":"Mark Accept-* request headers as simple / safe","user":{"login":"RubenVerborgh","id":675313,"avatar_url":"https://avatars.githubusercontent.com/u/675313?v=3","gravatar_id":"","url":"https://api.github.com/users/RubenVerborgh","html_url":"https://github.com/RubenVerborgh","followers_url":"https://api.github.com/users/RubenVerborgh/followers","following_url":"https://api.github.com/users/RubenVerborgh/following{/other_user}","gists_url":"https://api.github.com/users/RubenVerborgh/gists{/gist_id}","starred_url":"https://api.github.com/users/RubenVerborgh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/RubenVerborgh/subscriptions","organizations_url":"https://api.github.com/users/RubenVerborgh/orgs","repos_url":"https://api.github.com/users/RubenVerborgh/repos","events_url":"https://api.github.com/users/RubenVerborgh/events{/privacy}","received_events_url":"https://api.github.com/users/RubenVerborgh/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":7,"created_at":"2016-06-22T20:55:50Z","updated_at":"2016-06-23T17:05:03Z","closed_at":null,"body":"I recently had a rather troublesome experience getting CORS to work with the Memento framework.\r\n\r\n### Problem\r\n[Memento (RFC7089)](https://tools.ietf.org/html/rfc7089) provides additional HTTP headers to perform time-based content negotiation. Concretely:\r\n- client requests indicate their preference with `Accept-Datetime`\r\n- server responses indicate the timestamp with `Memento-Datetime`\r\n\r\nNegotiation can be performed in two ways [1]:\r\n- the server redirects to the negotiated representation with `302`\r\n- the server serves the negotiated representation with `200`\r\n  (using `Content-Location` to indicate its URL)\r\nFor various reasons, `302`-style negotiation is preferred.\r\n\r\nIn contrast to regular content type and language negotiation, however, **it is impossible to make time-based content negotiation work in the browser cross-origin with `302`-style negotiation**.\r\nThis is because the Fetch spec requires that requests with [non-simple headers](https://lists.w3.org/Archives/Public/public-webappsec/2016Jan/0119.html) (such as `Accept-Datetime`) are preceded by a preflight `OPTIONS` request asking the server permission to use such headers.\r\nMoreover, in cases that need such a preflight request, `30x` responses from the server are not accepted.\r\n\r\nIn other words: if the client wants to negotiate cross-origin on content type and language, `302` is allowed. If the client wants to negotiate cross-origin on time, `302` is not allowed and `200` is needed (which is not appropriate in several use cases).\r\n\r\n### Proposed solution\r\n\r\n**Could it be a considered to mark `Accept-*` headers safe on requests?** After all, no harm can be done with such headers (not more than with `Accept` or `Accept-Language`), so requiring preflight is not necessary.\r\n\r\n### Practical use case\r\n\r\nThe practical discussion of such a use case can be found [here](http://ruben.verborgh.org/blog/2016/06/22/querying-history-with-linked-data/), together with a [live demo](http://bit.ly/artists-york-2012) that uses a [preflight performance hack](https://github.com/LinkedDataFragments/Client.js/commit/a0438531bbfcbd36aec04c73ab16e8d0279f3ef). A different but related discussion was held [here](https://lists.w3.org/Archives/Public/public-webappsec/2013Feb/0078.html)."},"comment":{"url":"https://api.github.com/repos/whatwg/fetch/issues/comments/228115934","html_url":"https://github.com/whatwg/fetch/issues/326#issuecomment-228115934","issue_url":"https://api.github.com/repos/whatwg/fetch/issues/326","id":228115934,"user":{"login":"domenic","id":617481,"avatar_url":"https://avatars.githubusercontent.com/u/617481?v=3","gravatar_id":"","url":"https://api.github.com/users/domenic","html_url":"https://github.com/domenic","followers_url":"https://api.github.com/users/domenic/followers","following_url":"https://api.github.com/users/domenic/following{/other_user}","gists_url":"https://api.github.com/users/domenic/gists{/gist_id}","starred_url":"https://api.github.com/users/domenic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/domenic/subscriptions","organizations_url":"https://api.github.com/users/domenic/orgs","repos_url":"https://api.github.com/users/domenic/repos","events_url":"https://api.github.com/users/domenic/events{/privacy}","received_events_url":"https://api.github.com/users/domenic/received_events","type":"User","site_admin":false},"created_at":"2016-06-23T17:05:03Z","updated_at":"2016-06-23T17:05:03Z","body":"Isn't this proposal saying that you should be able to override CORS protections just by smuggling your header name with an `Accept-` prefix?"}}
{"actor":{"display_login":"domenic"}}