Requirements for CORS safe-list
Open
@dyladan is already working on this.
Since Jul 6, 2021.
revisit-later
- Dominant language
- Python
- Stars
- 510
- Forks
- 80
- PR merge metrics
- No merged PRs in 30d
Description
The CORS safelist is very tightly restricted. There are currently only 4 safe headers
AcceptAccept-LanguageContent-LanguageContent-Type
Even those are tightly restricted.
- For
Accept-LanguageandContent-Language: can only have values consisting of0-9,A-Z,a-z, space or*,-.;=. - For
AcceptandContent-Type: can't contain a CORS-unsafe request header byte:"():<>?@[\]{},Delete, Tab and control characters: 0x00 to 0x19. - For
Content-Type: needs to have a MIME type of its parsed value (ignoring parameters) of eitherapplication/x-www-form-urlencoded,multipart/form-data, ortext/plain. - For any header: the value’s length can't be greater than 128.
- The length of all header values combined can't be greater than 1024
The last 2 restrictions are the ones that I think are the biggest issues
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.