← Back to release summary

Enforce CORS in subresource SignedExchange prefetching

Category
Miscellaneous
Type
No developer-visible change
Status
Enabled by default (Chrome 106)
Intent stage
Shipped

Summary

Changes the request mode and credentials mode of prefetch requests used in Subresource prefetching+loading via Signed HTTP Exchange (https://chromestatus.com/feature/5126805474246656). Currently SignedExchange subresource prefetches (triggered by Link: rel="alternate") are requested with "no-cors" mode. After this change, SignedExchange subresource prefetches will be requested with "cors" mode and "same-origin" credentials mode. This means, subresource SignedExchanges prefetched from cross-origin must have an appropriate Access-Control-Allow-Origin response header.

Motivation

Using no-cors mode for subresource SignedExchange prefetching was not a well-thought-out decision. In principle new features shouldn't use no-cors. Also, no-cors prefetch will be blocked once ORB (Opaque Response Blocking) is fully enabled (https://github.com/annevk/orb/issues/32). See https://github.com/WICG/webpackage/issues/790 for more details and alternatives considered.

Standards & signals

View on chromestatus.com