CORs Requests

[dgstpierre]

When using XMLHttpRequest I don't need to worry about setting any accept-ch headers. I also avoid the costly overhead of a preflight call by limiting the headers sent. How will we be able to make third party API calls ensuring that the detailed ua client hints are sent and not introducing a preflight?

[Sora2455]

By adding the results of the UA JA API as part of the JSON body?

[dgstpierre]

We can do this as with any data. Just seems that we are adding lots of overhead for something that was seamless before.

[nicjansma]

Accept-CH can only be applied to the base page's HTTP response -- setting it on outgoing Fetch/XHRs will have no effect.

(then you would add a Permissions-Policy on the same base page HTTP response to delegate the required hints to the XHR domain)

[frankykubo]

Hello,

so if I understand this right @nicjansma , there is and probably will not be an approach to include high-entropy UA client hints like Arch without manually appending them to XHR's via JS Client hints API?

Thank you