Re:Browsers, JSON, and FormData
by lol768 on Saturday November 12, 2022 @01:11PM
(#33575483)
People rely on browsers not being able to POST a JSON body to a (cross-origin) API to prevent cross-site request forgery.
Maybe this is obsolete in a SameSite=Lax by default world, but simply allowing browsers to support a JSON enctype has consequences that need to be carefully thought through.
If you wanted browsers to do this properly, you'd probably need to send a pre-flight?
Maybe this is obsolete in a SameSite=Lax by default world, but simply allowing browsers to support a JSON enctype has consequences that need to be carefully thought through.
If you wanted browsers to do this properly, you'd probably need to send a pre-flight?