I just read on Wikipedia (based on W3 minutes) that CORS is now obsolete:
https://en.wikipedia.org/wiki/Cross-origin_resource_sharing
From the meeting minutes at https://www.w3.org/2017/08/16-webappsec-minutes.html#item03
Obsoleting CORS
dveditz: I raised on the list obsoleting CORS. The spec is old and doesn't reflect what browsers actually do
scribe ... ongoing work is in Fetch
UNKNOWN_SPEAKER: so it's not useful to have CORS sitting around
... mark as Obsolete and point to replacement
... to serve
implementors better
... only reply was mnot asking about CORS
for Developers
... I'd like to get Brad's feedback
...
I'll call for consensus on this call, and then announce on list
dveditz: any objection to obsoleting CORS?
terri: sounds reasonable to me
PROPOSED: Obsolete CORS
RESOLUTION: Obsolete CORS
dveditz: I'll announce that decision to the list
How is this possible, what allows CORS to be obsolete?
That discussion’s only about retiring the old CORS specification—basically, putting clear indications on it that it should no longer be used by implementors as the basis for implementations, and that implementors should use the Fetch spec at https://fetch.spec.whatwg.org/ instead.
The reason is, all current CORS requirements for browsers are in the Fetch spec, and the Fetch spec is the only specification for CORS that continues to be actively maintained—the only one to get refinements and spec-bug fixes, and to which any new CORS-related features will be added.
See https://lists.w3.org/Archives/Public/public-webappsec/2017Aug/0010.html:
We propose the following Status of the Document:
This document has been obsoleted. Do not implement this specification.
The Fetch Living Standard provides the same set of features with
additional refinements to improve security, such as the CORS
safelisted request headers. It also contains new features, which
would not be covered by the 5 February 2004 W3C Patent Policy, such as
the possibility to use a wildcard "*" in CORS headers.
So now the W3C Web Applications Security Working Group has made their decision, sometime very soon they’ll republish the old CORS specification with that text added to its Status section.
I just read on Wikipedia (based on W3 minutes) that CORS is now
obsolete:
https://en.wikipedia.org/wiki/Cross-origin_resource_sharing
I’ve just now updated that Wikipedia CORS article to state things more accurately:
The specification for CORS was originally published as a W3C Recommendation but that document is obsolete. The current actively-maintained specification that defines CORS is the Fetch Living Standard.