[1]

CORSコルス (Cross-Origin Resource Sharing、起源間資源共有、HTTP CORS プロトコルprotocolとも。) は、同一起源ポリシーの制約を超えて Webアプリケーションが異なる起源の資源にアクセスするための仕組みです。

[61]

XHR その他の DOM API や HTML要素などを使って HTTP アクセスを行う際に用いられます。

歴史

[3] CORS は元々は VoiceXML Working Group により <?access-control?> 処理指令として検討されていましたが、 Web Apps WG に引き継がれ、HTTP 頭欄 Access-Control: 頭欄などを経て、最終的に現在の形になりました。

[4] 旧案時代の歴史は <?access-control?> の項を参照してください。

W3C CORS

[28] Cross-Origin Resource Sharing (2012-03-01 14:27:55 +09:00 版) http://dvcs.w3.org/hg/cors/raw-file/tip/Overview.html#introduction

[30] CORS の応用の一覧は CORS API仕様の項をご覧ください。

XHR + CORS

対応ブラウザ

[8] Firefox 3.5+ (2009/6) >>7, >>13
[9] Chrome >>7, >>13
- [16] Chrome 2 (2009/5) は既に対応している >>15
- [17] 世間では Chrome2 以降説と Chrome3 以降説が流布されているw 実際にいつから実装されてるのか不明 2011-04-24T02:36:05.800Z
[10] Safari 4+ (2009/6) >>7, >>13
[12] Opera >>13
- [14] >>13 には対応していると書いてあるものの、公式情報を見つけられないので要検証。 Opera 10 は未対応。

XDR

対応ブラウザ

[11] IE 8+ (2009/3) >>7, >>13

[18] IE (少なくても 8) では Cookie を送らせることができない。

出典

[7] XMLHttpRequest - Wikipedia (2011-03-23 04:23:06 +09:00 版) http://ja.wikipedia.org/wiki/XMLHttpRequest#.E3.82.AF.E3.83.AD.E3.82.B9.E3.83.89.E3.83.A1.E3.82.A4.E3.83.B3
[13] XMLHttpRequest - Wikipedia, the free encyclopedia (2011-04-21 07:37:09 +09:00 版) http://en.wikipedia.org/wiki/XMLHttpRequest#Cross-domain_requests
[15] XMLHttpRequest Level 2 と wedata バックアップ - 0xFF (2011-04-24 11:31:24 +09:00 版) http://d.hatena.ne.jp/os0x/20090610/1244618814

HTML との統合

[5] IRC logs: freenode / #whatwg / 20101014 ( (2010-10-24 00:00:38 +09:00 版)) http://krijnhoetmer.nl/irc-logs/whatwg/20101014#l-476

[6] IRC logs: freenode / #whatwg / 20101103 ( (2010-11-13 16:04:31 +09:00 版)) http://krijnhoetmer.nl/irc-logs/whatwg/20101103

[19] Web Applications 1.0 r6142 First draft for working out how to use CORS with <img>, <video>, and <audio>. ( (2011-05-18 10:09:00 +09:00 版)) http://html5.org/tools/web-apps-tracker?from=6141&to=6142

[20] IRC logs: freenode / #whatwg / 20110520 ( (2011-05-22 19:41:16 +09:00 版)) http://krijnhoetmer.nl/irc-logs/whatwg/20110520

[21] Web Applications 1.0 r6144 Update how CORS works with <img> and <video> (and <audio> and <track>). ( (2011-05-24 05:43:00 +09:00 版)) http://html5.org/tools/web-apps-tracker?from=6143&to=6144

[22] Web Applications 1.0 r6147 Change cross-origin= to crossorigin= since people don't seem to like hyphens. Poor hyphens. ( (2011-05-24 06:29:00 +09:00 版)) http://html5.org/tools/web-apps-tracker?from=6146&to=6147

[23] Web Applications 1.0 r6255 CORS-enable EventSource, for cross-site event streams ( (2011-06-18 04:57:00 +09:00 版)) http://html5.org/tools/web-apps-tracker?from=6254&to=6255

[24] [whatwg] CORS requests for image and video elements ( (2011-06-20 23:44:55 +09:00 版)) http://lists.whatwg.org/htdig.cgi/whatwg-whatwg.org/2011-May/031764.html

[25] [whatwg] Enhancement request: change EventSource to allow cross-domain access (2011-06-24 11:50:30 +09:00 版) http://lists.whatwg.org/pipermail/whatwg-whatwg.org/2011-June/032212.html

[26] [whatwg] [CORS] WebKit tainting image instead of throwing error (2011-10-05 07:26:20 +09:00 版) http://lists.whatwg.org/pipermail/whatwg-whatwg.org/2011-October/033389.html

[27] IRC logs: freenode / #whatwg / 20111011 ( (2011-10-12 00:08:40 +09:00 版)) http://krijnhoetmer.nl/irc-logs/whatwg/20111011

[2] Cross-Origin Resource Sharing http://dev.w3.org/2006/waf/access-control/

[29] >>2 が最新版の仕様書でしたが、 hg に移行したため現在は >>28 が最新版となっています。

[31] Cross-Origin Resource Sharing ( (2012-04-03 23:15:58 +09:00 版)) http://www.w3.org/TR/2012/WD-cors-20120403/

[32] [whatwg] [html5] r7128 - [giow] (2) Try to define img synchronous loading. Affected topics: HTML ( (2012-08-30 01:12:43 +09:00 版)) http://lists.whatwg.org/pipermail/whatwg-whatwg.org/2012-August/037037.html

[35] CORS - W3C Wiki ( (2012-11-27 20:36:18 +09:00 版)) http://www.w3.org/wiki/CORS

[36] Cross-Origin Resource Sharing ( (2013-01-30 02:32:11 +09:00 版)) http://www.w3.org/TR/2013/CR-cors-20130129/

Fetch Standard へ

[48] 2012年初秋、 Anne が Opera を離れたことをきっかけに CORS は W3C から WHATWG へ移りましたが、懸案であった HTML Fetch との統合を見据えて fetch.spec.whatwg.org というドメイン名が選ばれました。

[33] Cross-Origin Resource Sharing Standard ( (2012-09-13 21:51:45 +09:00 版)) http://fetch.spec.whatwg.org/

[34] W3C TPAC: CORS — Anne’s Blog ( (2012-11-23 13:30:05 +09:00 版)) http://annevankesteren.nl/2012/11/cors

[49] 2013年春には HTML Fetch と CORS を統合して書きなおされた新しい Fetch Standard に置き換えられました。これによって単体の仕様書としての CORS は役目を終えました。

[37] Fetch: HTTP authentication and CORS ( (Anne van Kesteren 著, 2013-05-03 21:57:46 +09:00 版)) http://lists.w3.org/Archives/Public/public-webapps/2013AprJun/0487.html

[38] カスタムヘッダを使ったCSRF対策は安全に使えるかどうかということについて - 金利0無利息キャッシング – キャッシングできます - subtech ( (2013-06-12 01:28:13 +09:00 版)) http://subtech.g.hatena.ne.jp/mala/20130304/1362392723

[39] [whatwg] Fetch: please review! ( (2013-06-20 08:48:41 +09:00 版)) http://lists.whatwg.org/pipermail/whatwg-whatwg.org/2013-June/039809.html

[40] IRC logs: freenode / #whatwg / 20131028 ( (2013-10-29 22:31:33 +09:00 版)) http://krijnhoetmer.nl/irc-logs/whatwg/20131028

W3C CORS 勧告

[50] 新しい Fetch Standard に統合された後も W3C Process 上 CORS 仕様書は残り続け、 2014年1月にはようやく W3C勧告となりました。 (しかし内容は Fetch との統合前の古いまま、つまり2年遅れです。)

[41] Cross-Origin Resource Sharing ( (2013-12-05 05:33:19 +09:00 版)) http://www.w3.org/TR/2013/PR-cors-20131205/

[42] CORS report ( ( 著, 2012-12-05 18:21:07 +09:00 版)) http://odinho.html5.org/CORS/testsuite-report.html

[43] CORS Edited PR report ( ( 著, 2013-08-16 05:30:57 +09:00 版)) http://webappsec-test.info/~bhill2/pub/CORS/cors-test-supplement.htm

[46] Cross-Origin Resource Sharing ( (2014-01-16 07:53:22 +09:00 版)) http://www.w3.org/TR/2014/REC-cors-20140116/

その後

[44] Re: [beacon] Random comments ( (Jonas Sicking 著, 2013-12-20 04:43:42 +09:00 版)) http://lists.w3.org/Archives/Public/public-web-perf/2013Dec/0108.html

[45] Bug 14703 – Integrate style sheet loading with CSSOM ( (2014-01-14 09:00:15 +09:00 版)) https://www.w3.org/Bugs/Public/show_bug.cgi?id=14703

[55] Web Applications 1.0 r8634 Big editorial cleanup. No normative changes. ( (2014-05-15 08:21:00 +09:00 版)) http://html5.org/tools/web-apps-tracker?from=8633&to=8634

[56] Let CORS preflight fetch perform its own CORS check. Also if a CORS cach... · 49eb9d0 · whatwg/fetch ( (2014-09-10 02:48:50 +09:00 版)) https://github.com/whatwg/fetch/commit/49eb9d0e649331f9364a06767e5a17fc6155107b

[57] CORS performance (Anne van Kesteren 著, 2015-02-18 03:39:42 +09:00 版) https://lists.w3.org/Archives/Public/public-webapps/2015JanMar/0646.html

[58] Re: CORS performance (Anne van Kesteren 著, 2015-02-19 20:30:46 +09:00 版) https://lists.w3.org/Archives/Public/public-webapps/2015JanMar/0672.html

[59] CORS performance proposal (Anne van Kesteren 著, 2015-02-19 22:29:24 +09:00 版) https://lists.w3.org/Archives/Public/public-webappsec/2015Feb/0350.html

[60] Re: CORS performance (Jonas Sicking 著, 2015-02-20 05:20:38 +09:00 版) https://lists.w3.org/Archives/Public/public-webapps/2015JanMar/0696.html

[62] Re: [webappsec] CfC: Proposed non-normative updates to CORS (Mike West 著, 2015-07-01 15:49:16 +09:00 版) https://lists.w3.org/Archives/Public/public-webappsec/2015Jul/0002.html

[63] Merge pull request #485 from fmarier/sri-issue418 · w3c/webappsec@73e50e6 (2015-09-29 16:00:13 +09:00 版) https://github.com/w3c/webappsec/commit/73e50e6c3cd437a0c8921dd95b539f152fd85cae

[64]

Safari 4.0 (2015-11-04 22:53:31 +09:00 版) https://developer.apple.com/library/safari/releasenotes/General/WhatsNewInSafari/Articles/Safari_4_0.html#//apple_ref/doc/uid/TP40014305-CH4-SW15

WebKit now has basic support for cross-site XML HTTP requests using W3C XMLHttpRequest Level 2 and W3C access control for cross-site requests. This provides a way for servers to specify that a cross-site request is allowed, by sending an Access-Control HTTP response header.

[65] Fix #152: give up on forced CORS preflights being a mode · whatwg/fetch@2ca5730 (2015-11-26 13:46:07 +09:00 版) https://github.com/whatwg/fetch/commit/2ca5730755795a4fc5e50c06f8fc477adb931d74

[66] Align with Fetch, forcing a CORS preflight is a flag again · whatwg/xhr@6ebf187 (2015-11-26 13:46:22 +09:00 版) https://github.com/whatwg/xhr/commit/6ebf187740869fe85893abcfcfa5a5e629a6584b

[67] Fix #169: make "no-cors" work with any credentials mode · whatwg/fetch@4147978 (2016-01-13 12:08:56 +09:00 版) https://github.com/whatwg/fetch/commit/4147978673c15047d1a5d4a76b1a403a7d75a956

[70] Fix #202: attempt to define CORS filtered response a little clearer · whatwg/fetch@b17b985 (2016-01-30 12:34:12 +09:00 版) https://github.com/whatwg/fetch/commit/b17b9859ae66de798cbad8759a8c84e7395a2557

[68] [integration] References to external resources · w3c/svgwg@6257fcb (2016-02-05 14:34:25 +09:00 版) https://github.com/w3c/svgwg/commit/6257fcb92ba52ca231d412a6b505b2c71650d215

[69] "With Credentials" flag possibly inconsistent with web architecture · Issue #76 · w3ctag/spec-reviews (2016-03-15 11:54:22 +09:00 版) https://github.com/w3ctag/spec-reviews/issues/76

[71] CORS and RFC1918 (2016-03-03 19:13:16 +09:00 版) https://mikewest.github.io/cors-rfc1918/

[72] Explain CORS protocol and credentials interaction ( (annevk著, 2016-05-05 19:34:15 +09:00)) https://github.com/whatwg/fetch/commit/c9e8db9d9075989fd2b91203f0247c52bac0ca27

[73] "With Credentials" flag possibly inconsistent with web architecture · Issue #76 · w3ctag/spec-reviews ( (2016-05-06 10:56:04 +09:00)) https://github.com/w3ctag/spec-reviews/issues/76

[74] Allow more wildcards in CORS when used without credentials ( (annevk著, 2016-05-24 18:42:09 +09:00)) https://github.com/whatwg/fetch/commit/cdbb13c08650b10c9ebfc54d046bec0639e7ba7c

[75] Redirect on preflighted CORS requests generally impossible · Issue #204 · whatwg/fetch ( (2016-05-25 13:13:45 +09:00)) https://github.com/whatwg/fetch/issues/204#issuecomment-184257430

[76] CO Redirect in the face of CORs may not be correct in specs · Issue #32 · w3c/beacon (2016-06-30 12:03:34 +09:00) https://github.com/w3c/beacon/issues/32

[77] Merge pull request #33 from w3c/nocors (toddreifsteck著, 2016-06-30 08:57:52 +09:00) https://github.com/w3c/beacon/commit/62f466477436042108f8d2cb92bc1c6cae1644ed

[78] Align Fetch's destination concept with changes in Fetch (sideshowbarker著, 2016-07-05 02:46:14 +09:00) https://github.com/whatwg/html/commit/5e8f96a85d182d36c177db0d6fdde58b4ded86d4

[79] Allow for redirects after a CORS-preflight (annevk著, 2016-08-04 21:15:29 +09:00) https://github.com/whatwg/fetch/commit/0d9a4db8bc02251cc9e391543bb3c1322fb882f2

[80] Merge pull request #34 from w3c/cors-whitelist (plehegar著, 2016-08-18 04:31:50 +09:00) https://github.com/w3c/beacon/commit/b917e89fbe0e448e3318428b33d7fb9a66820cea

[81] [webappsec] WG Note: CORS for developers (Brad Hill著, 2016-09-14 08:17:11 +09:00) https://lists.w3.org/Archives/Public/public-webappsec/2016Sep/0047.html

[82] CORS for Developers (2016-09-14 14:00:25 +09:00) https://w3c.github.io/webappsec-cors-for-developers/

[83] Remove request's omit-Origin-header flag (annevk著, 2016-12-09 16:37:16 +09:00) https://github.com/whatwg/fetch/commit/eb89fcd54bb39e81b11c569f6ad7ba615883f7b9

[84] Clarify requirements on a CORS server (annevk著, 2017-03-30 20:21:45 +09:00) https://github.com/whatwg/fetch/commit/9289687f43b2f88fe5480f989f59fdb6eb602ac6

[85] Re: Propose "Obsolete" status for CORS spec (Mark Nottingham著, 2017-08-01 10:04:32 +09:00) https://lists.w3.org/Archives/Public/public-webappsec/2017Aug/0000.html

[86] Last call: Obsoleting CORS (Daniel Veditz著, 2017-08-17 09:07:58 +09:00) https://lists.w3.org/Archives/Public/public-webappsec/2017Aug/0005.html

[87] Web Application Security WG -- 16 Aug 2017 (2017-08-17 01:23:37 +09:00) https://www.w3.org/2017/08/16-webappsec-minutes.html

[88] Transition Request: Proposed Obsolete for CORS (Daniel Veditz著, 2017-08-26 04:42:30 +09:00) https://lists.w3.org/Archives/Public/public-webappsec/2017Aug/0010.html

[89] Using integrity with "no-cors" is fine same-origin (annevk著, 2017-09-02 01:19:38 +09:00) https://github.com/whatwg/fetch/commit/686a1ad9e1c5a001531ebabb1bcd163dfe78edd8

[90] Adjust CORS wildcard handling slightly (annevk著, 2017-09-07 17:48:36 +09:00) https://github.com/whatwg/fetch/commit/358dbf5296d91bb791d864b677b367bb11b3bf37

[91] Adjust wildcard handling slightly by annevk · Pull Request #592 · whatwg/fetch (2017-09-08 14:54:04 +09:00) https://github.com/whatwg/fetch/pull/592

[92] Access-Control-Expose-Headers: * can be interpreted in two ways · Issue #548 · whatwg/fetch (2017-09-08 14:54:25 +09:00) https://github.com/whatwg/fetch/issues/548

[93] Re: CORS should be abandoned (Boris Zbarsky著, 2017-10-14 00:42:28 +09:00) https://lists.w3.org/Archives/Public/public-webapps/2017OctDec/0044.html

[94] Do not allow CORS responses to "same-origin" requests (annevk著, 2018-01-06 20:56:46 +09:00) https://github.com/whatwg/fetch/commit/548bca234ad5d0296030b2384cc0b784799c4664

[95] 1427978 - Update the WPT test we expected failure after rejecting the CORS synthesized response for the same-origin request (2018-01-09 11:28:26 +09:00) https://bugzilla.mozilla.org/show_bug.cgi?id=1427978

[96] consider failing same-origin fetch requests that get a cross-origin cors Response synthesized by a service worker · Issue #629 · whatwg/fetch (2018-01-09 11:28:53 +09:00) https://github.com/whatwg/fetch/issues/629

[97] Do not allow CORS responses to "same-origin" requests by annevk · Pull Request #655 · whatwg/fetch (2018-01-09 11:28:59 +09:00) https://github.com/whatwg/fetch/pull/655

[98] Return a network error for mode "no-cors" and redirect mode not "follow" (youennf著, 2018-01-23 21:23:16 +09:00) https://github.com/whatwg/fetch/commit/14858d3e9402285a7ff3b5e47a22896ff3adc95d

[99] Return a network error in case of no-cors mode and redirect being not follow by youennf · Pull Request #663 · whatwg/fetch (2018-01-24 12:58:14 +09:00) https://github.com/whatwg/fetch/pull/663

[100] Deprecations and removals in Chrome 66 | Web | Google Developers (2018-03-30 01:37:56 +09:00) https://developers.google.com/web/updates/2018/03/chrome-66-deprecations

[101] Export the definition of CORS-same-origin by csnardi · Pull Request #3605 · whatwg/html (2018-04-04 15:46:38 +09:00) https://github.com/whatwg/html/pull/3605

[102] IETF HTML5 Meeting March 2009 - W3C Wiki (2018-04-21 13:28:11 +09:00) https://www.w3.org/wiki/IETF_HTML5_Meeting_March_2009

[103] Avoid using the CORS flag to reset request's origin in redirects by annevk · Pull Request #594 · whatwg/fetch (2018-06-01 01:01:46 +09:00) https://github.com/whatwg/fetch/pull/594

[104] Make CORS-preflight fetches set the CORS flag (annevk著, 2018-05-28 21:39:53 +09:00) https://github.com/whatwg/fetch/commit/9334fcbd34dc17e4508582c9fdc57f20ba5b728e

[105] Remove Reporting API from CORS exceptions (dcreager著, 2018-07-31 17:03:24 +09:00) https://github.com/whatwg/fetch/commit/b3492ec22778d1e5705432d80b82dfa7664aedf0

[106] Remove Reporting API from CORS exceptions by dcreager · Pull Request #776 · whatwg/fetch (2018-08-05 14:58:53 +09:00) https://github.com/whatwg/fetch/pull/776

[107] Are report uploads supposed to send CORS preflights? · Issue #41 · w3c/reporting (2018-08-05 15:00:02 +09:00) https://github.com/w3c/reporting/issues/41

[108] Clarify CORS behavior for report uploads by dcreager · Pull Request #97 · w3c/reporting (2018-08-05 15:01:27 +09:00) https://github.com/w3c/reporting/pull/97

[109] Strengthen requirements on CORS even further by having a maximum comb… (annevk著, 2018-05-30 21:31:43 +09:00) https://github.com/whatwg/fetch/commit/e2d62ff1df77105c519360948174a135c5eabb6c

[110] CORS-safelisted request headers should be restricted according to RFC 7231 · Issue #382 · whatwg/fetch (2018-08-22 19:09:16 +09:00) https://github.com/whatwg/fetch/issues/382

[111] Strengthen requirements on Headers with guard "request-no-cors" (annevk著, 2018-05-30 20:28:48 +09:00) https://github.com/whatwg/fetch/commit/cb30d8c72879b18b1e03dc3609d1976d871c28c2

[112] Cleanup remaining Document/Window object relations (annevk著, 2018-08-17 18:45:49 +09:00) https://github.com/whatwg/html/commit/39dbb3e6de4216476cf7193ad9e5d56a861d5297

[113] Editorial: use "append" to modify the header list (ryzokuken著, 2018-09-10 21:41:01 +09:00) https://github.com/whatwg/fetch/commit/daca6a824c0c6c5e22b7f7eb70001f36c1732cb1

[114] Use "append" instead of "set" to modify the header list · Issue #758 · whatwg/fetch (2018-10-17 13:04:32 +09:00) https://github.com/whatwg/fetch/issues/758

[115] Editorial: Use "append" to modify the header list by ryzokuken · Pull Request #807 · whatwg/fetch (2018-10-17 13:04:47 +09:00) https://github.com/whatwg/fetch/pull/807

[116] Make CORS-preflight fetches set the CORS flag (annevk著, 2018-05-28 21:39:53 +09:00) https://github.com/whatwg/fetch/commit/9334fcbd34dc17e4508582c9fdc57f20ba5b728e

[117] CORS-preflight fetch · Issue #741 · whatwg/fetch (2019-02-27 13:52:24 +09:00) https://github.com/whatwg/fetch/issues/741

[118] Make CORS-preflight fetches set the CORS flag by annevk · Pull Request #743 · whatwg/fetch (2019-02-27 13:52:33 +09:00) https://github.com/whatwg/fetch/pull/743

[119] Editorial: remove leftover sentence (annevk著, 2018-10-17 18:00:23 +09:00) https://github.com/whatwg/fetch/commit/eaaa050abd1904756a25fdc4219a372fe133869f

[120] Editorial: remove leftover sentence by annevk · Pull Request #815 · whatwg/fetch (2019-03-04 18:43:52 +09:00) https://github.com/whatwg/fetch/pull/815

[121] Refactor the CORS check (annevk著, 2018-11-06 00:30:35 +09:00) https://github.com/whatwg/fetch/commit/3fb65a008886005a0ad2821e76933f971f27ea60

[122] Refactor the CORS check (annevk著, 2018-11-06 00:30:35 +09:00) https://github.com/whatwg/fetch/commit/3fb65a008886005a0ad2821e76933f971f27ea60

[123] Refactor the CORS check by annevk · Pull Request #824 · whatwg/fetch (2019-03-08 12:23:41 +09:00) https://github.com/whatwg/fetch/pull/824

[124] Introduce a bit to indicate the server doesn't do IP-based authentication · Issue #1993 · quicwg/base-drafts (2019-03-12 12:07:16 +09:00) https://github.com/quicwg/base-drafts/issues/1993

[125] fetch() "no-cors": cross-origin to same-origin redirect taints response · Issue #737 · whatwg/fetch (2019-04-19 14:43:10 +09:00) https://github.com/whatwg/fetch/issues/737

[126] Memorandum of Understanding Between W3C and WHATWG (2019-05-28 17:23:37 +09:00) https://www.w3.org/2019/04/WHATWG-W3C-MOU.html

[127] Editorial: use %s ABNF notation (annevk著, 2018-12-12 20:25:58 +09:00) https://github.com/whatwg/fetch/commit/e69e9c2b73b1aac124de47e8f32ee8979dfdb77a

[128] Note that cookies take effect despite CORS failures (Osintopsec著, 2019-01-23 20:16:10 +09:00) https://github.com/whatwg/fetch/commit/d219389264742ce9bb3411601f680f54a77e2f3a

[129] Doc: failed CORS fetch with credentials should ignore Set-Cookie response header · Issue #855 · whatwg/fetch (2019-06-18 15:24:30 +09:00) https://github.com/whatwg/fetch/issues/855

[130] Change 3.2.6 Examples to reflect current state of implementations by Osintopsec · Pull Request #858 · whatwg/fetch (2019-06-18 15:26:41 +09:00) https://github.com/whatwg/fetch/pull/858

[131] Editorial: spell no-cors no-CORS as part of names (annevk著, 2018-11-15 00:08:26 +09:00) https://github.com/whatwg/fetch/commit/00ef0c4215e481a465dba18542fd8b4e3b236504

[132] Headers API corrections by annevk · Pull Request #833 · whatwg/fetch (2019-06-19 13:57:02 +09:00) https://github.com/whatwg/fetch/pull/833

[133] Close no-CORS Headers API holes (annevk著, 2018-11-15 00:48:05 +09:00) https://github.com/whatwg/fetch/commit/ba2fb9c3916e7b420b2efbe70a215d2ee0d5a01e

[134] Headers API corrections by annevk · Pull Request #833 · whatwg/fetch (2019-06-21 12:41:03 +09:00) https://github.com/whatwg/fetch/pull/833

[135] Set CORS preflight requests' mode to "cors" (mikewest著, 2019-07-16 21:36:35 +09:00) https://github.com/whatwg/fetch/commit/2d0d7bdec1880ed1d7df091c9d2f7604ea9f2a9c

[136] Set CORS preflight requests' `mode` to `cors`. by mikewest · Pull Request #916 · whatwg/fetch (2020-01-12 16:28:14 +09:00) https://github.com/whatwg/fetch/pull/916

[137] Decide on the proper `mode' value for CORS preflight requests · Issue #35 · w3c/webappsec-fetch-metadata (2020-01-12 16:28:41 +09:00) https://github.com/w3c/webappsec-fetch-metadata/issues/35

[138] Add Accept: */* to CORS-preflight request's headers (perryjiang著, 2019-09-27 18:42:12 +09:00) https://github.com/whatwg/fetch/commit/412723bae95dcc1541e6aad13b8bf42d8afcfe93

[139] specify default accept header on cors preflight · Issue #922 · whatwg/fetch (2020-02-01 14:47:35 +09:00) https://github.com/whatwg/fetch/issues/922

[140] Add Accept: */* to CORS-preflight requests' headers by perryjiang · Pull Request #941 · whatwg/fetch (2020-02-01 14:48:06 +09:00) https://github.com/whatwg/fetch/pull/941

[141] CORS 回避ってなんやねんw プロトコルを理解していない証拠やな

[142] Cross-Origin Resource Sharing (2020-06-02 02:20:05 +09:00) https://www.w3.org/TR/2020/SPSD-cors-20200602/

[143] Editorial: remove the CORS flag (annevk, 2019-11-11 19:02:42 +09:00, 2021-03-16T07:18:45.000Z) https://github.com/whatwg/fetch/commit/65138f3f20a80020e405c5a0fb3675abfd884013

[144] Remove the CORS flag by annevk · Pull Request #960 · whatwg/fetch (2021-03-16T07:24:31.000Z) https://github.com/whatwg/fetch/pull/960

仕様書

概要

HTTP CORS プロトコル

CORS 属性

関連

歴史

W3C CORS

XHR + CORS

対応ブラウザ

XDR

対応ブラウザ

出典

HTML との統合

Fetch Standard へ

W3C CORS 勧告

その後