News for hackers. Stuff that matters.

A comment on Show HN: I created a URL shortener that can be entirely hosted on GitHub Pages. Parent comment

Re:Show HN: I created a URL shortener that can be entirely h... by nelsontky on Monday November 16, 2020 @08:51AM (#25111574)
What I meant was that GitHub's API does not check for the Host header, and the API allows connections from any source. Thus, CORS isn't an issue at all.
[ Parent | on HN ]
Re:Show HN: I created a URL shortener that can be entirely h... by oneeyedpigeon on Monday November 16, 2020 @08:54AM (#25111609)
But the same-origin policy implemented by your browser should prevent the request before it gets anywhere near the API.
[ Parent | on HN ]
Re:Show HN: I created a URL shortener that can be entirely h... by hunter2_ on Monday November 16, 2020 @09:25AM (#25111957)
No, when a script tells a browsers to make a cross-origin request such as a GET or POST, the browser first makes a "pre-flight" request (without the payload) using the OPTIONS method to see what CORS-related response headers come back. If headers are returned that allow for it to proceed, the browser then makes whatever request the script asked for.

The network tab of developer tools should reveal all of this.

[ Parent | on HN ]