De-XHRify HTTP: everything except CORS #31013
Conversation
| `Access-Control-Allow-Credentials` header) and the client (by setting the | ||
| credentials mode for the XHR, Fetch, or Ajax request) must indicate that they're opting | ||
| into including credentials. | ||
| The `Access-Control-Allow-Credentials` header works in conjunction with the `credentials` option in the {{domxref("Request.Request()", "Request()")}} constructor of the Fetch API or the {{domxref("XMLHttpRequest.withCredentials")}} property. For a CORS request with credentials, for browsers to expose the response to the frontend JavaScript code, both the server (using the `Access-Control-Allow-Credentials` header) and the client (by setting the credentials mode for the XHR, Fetch, or Ajax request) must indicate that they're opting into including credentials. |
There was a problem hiding this comment.
I also find For a CORS request with credentials, for browsers to expose the response to the frontend JavaScript code, both the server (using the Access-Control-Allow-Credentials header) and the client (by setting the credentials mode for the XHR, Fetch, or Ajax request) must indicate that they're opting into including credentials. a very complicated (but correct) sentence; can we express it differently? I'm afraid it would be too complicated for non-native speakers.
| The `Access-Control-Allow-Credentials` header works in conjunction with the `credentials` option in the {{domxref("Request.Request()", "Request()")}} constructor of the Fetch API or the {{domxref("XMLHttpRequest.withCredentials")}} property. For a CORS request with credentials, for browsers to expose the response to the frontend JavaScript code, both the server (using the `Access-Control-Allow-Credentials` header) and the client (by setting the credentials mode for the XHR, Fetch, or Ajax request) must indicate that they're opting into including credentials. | |
| The `Access-Control-Allow-Credentials` header works in conjunction with the `credentials` option in the {{domxref("Request.Request()", "Request()")}} constructor of the Fetch API, or with the {{domxref("XMLHttpRequest.withCredentials")}} property. For a CORS request with credentials, for browsers to expose the response to the frontend JavaScript code, both the server (using the `Access-Control-Allow-Credentials` header) and the client (by setting the credentials mode for the XHR, Fetch, or Ajax request) must indicate that they're opting into including credentials. |
There was a problem hiding this comment.
That's fair. When I made these changes I didn't pay much attention to the wider semantics. Now I do, I don't think this description is very comprehensible, so I have had a go at rewriting it in 121ec81. Would love a fact check.
There was a problem hiding this comment.
In particular I thought phrases like "the response is ignored by the browser and not returned to the web content" are confusing. As a web developer, what does this look like?
files/en-us/web/http/headers/access-control-allow-credentials/index.md
Outdated
Show resolved
Hide resolved
* De-XHRify HTTP: everything except CORS * Update note about client/server and push * Rewrite Access-Control-Allow-Credentials * Clarification * Update files/en-us/web/http/headers/access-control-allow-credentials/index.md * Set codeface --------- Co-authored-by: Jean-Yves Perrier <jypenator@gmail.com>
Part of #31010. Tiny changes.
This should cover everything except the main CORS page.