Do You Really Know CORS?
This is an awesome overview! But don't take it as all encompassing, it doesn't go into some of the more esoteric edge cases with CORS, like:<p>* either an unreleased safari version, or the most recent version will send preflight requests even if the request meets the spec (like if the Accept-Language is set to something they don't like).<p>* If you use the ReadableStream API with fetch in the browser, a preflight will be sent.<p>* If there are any events attached on the XMLHttpRequestUpload.upload listener, it will cause a preflight<p>* cross-domain @font-face urls, images drawn to a canvas using the drawImage stuff, and some webGL things will also obey CORS<p>* the crossorigin attribute will be required for cross-origin linked images or css, or the response will be opaque and js won't have access to anything about it.<p>* if you mess up CORS stuff, you get opaque responses, and opaque responses are "viral", so they can cause entire canvas elements to become "blacklisted" and extremely restricted.<p>I feel like I've cut my teeth on this API more than most, and I still feel like I'm only scratching the surface!