For some real fun try accessing a redirect's resource when the redirector requires an Authorization header. You'll need 4 separate round trips, and the final endpoint will need to restrict requests based on Referer in addition to Origin, meaning you need to write all your own preflighting logic.
How to win at CORS
11–20 of 128 posts
Re: How to win at CORS
#12How they jump into the article without explaining or even expanding what the CORS acronym stands for.
It means Cross-Origin Resource Sharing. You can read about it at https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
I agree though that it is good practice to say what acronyms mean when using them.
Re: How to win at CORS
#13How they jump into the article without explaining or even expanding what the CORS acronym stands for.
If you don't already know what CORS is, you're probably not a Web developer and don't need to know.
I think this is misguided reasoning. Everyone starts somewhere, and the hallmark of reasonably competent writing is a ramp-up. Whether it’s one sentence or one chapter.
I think failing to define acronyms is a violation of just about any style guide out there.
Communication is a majority of engineering so I think these things are very important.
Re: How to win at CORS
#14Point of fairly idle curiosity about the presentation of the article: why do you put a trailing slash on your empty elements (img, link) in your code samples? Some aren’t aware that the trailing slash is useless in the HTML syntax, simply being ignored by the parser and not doing anything. (Except for in inline SVG and MathML content, which switch the parser into a more XML-like mode where the trailing slash behaves…
Author here! I used to have strong feelings about formatting stuff like this, but I since realised there are better things to spend effort on.
For formatting, I just let https://prettier.io/ do it's thing, and it added the />. Although I do configure it to use single quotes in JS, so I guess I still have some opinion there.
In terms of HTML, how far does your "but it isn't necessary" opinion go? Lots of closing elements are unnecessary in HTML, for instance, check out the source of https://fetch.spec.whatwg.org/
Re: How to win at CORS
#15How they jump into the article without explaining or even expanding what the CORS acronym stands for.
If you don't already know what CORS is, you're probably not a Web developer and don't need to know.
To be fair, there are many web devs who have never needed to worry about cross origin resource sharing
Re: How to win at CORS
#16Earlier quoted context omitted.
For me, adding the ending slash is just like adding semicolons at the end of javascript statements. They may be optional sometimes, but there is something to be said about consistency and clarity that comes with using them always. Less cognitive overload to boot.
Aren't they optional 100% of the time though?
Not 100%. There are a small handful of really wicked gotchas. I think there’s a lot of articles on them. I can’t find the one I like and don’t want to share one I haven’t read yet.
Re: How to win at CORS
#17How they jump into the article without explaining or even expanding what the CORS acronym stands for.
Author here! I added a small reference to the acronym in the article, but I don't think it really matters.
I actually forgot what it stands for the other week, but it didn't prevent me understanding it. And relearning the acronym didn't help me understand it more.
Re: How to win at CORS
#18Earlier quoted context omitted.
For me, adding the ending slash is just like adding semicolons at the end of javascript statements. They may be optional sometimes, but there is something to be said about consistency and clarity that comes with using them always. Less cognitive overload to boot.
Although there are certainly some similarities, trailing slash on empty tags is a different case to automatic semicolon insertion. Semicolons are mostly optional, but the trailing slash is never required, and does absolutely nothing—most specifically, it doesn’t close tags, and that’s what I’m getting at with my position of the trailing slash being mildly harmful: it’s teaching a mental model that’s simply wrong.
The name is literally a "self-closing tag", isn't it? And it's better for someone else reading: you may not recall what the tag is, but you know you don't have to look for a closing tag below.
Re: How to win at CORS
#19Point of fairly idle curiosity about the presentation of the article: why do you put a trailing slash on your empty elements (img, link) in your code samples? Some aren’t aware that the trailing slash is useless in the HTML syntax, simply being ignored by the parser and not doing anything. (Except for in inline SVG and MathML content, which switch the parser into a more XML-like mode where the trailing slash behaves…
Author here! I used to have strong feelings about formatting stuff like this, but I since realised there are better things to spend effort on. For formatting, I just let https://prettier.io/ do it's thing, and it added the />. Although I do configure it to use single quotes in JS, so I guess I still have some opinion there. In terms of HTML, how far does your "but it isn't necessary" opinion go? Lots of closing eleme…
Well, for my own personal stuff I omit just about all that I can—head/body start and end tags, html end tag (not start tag because it has at least a lang attribute), tbody start tag where possible, thead/tbody/tfoot/tr/th/td/li/dt/dd/p end tags almost all of the time, attribute value quotes where valid… mostly just because it’s fun doing so, and in some cases because it makes things decidedly cleaner (especially tables). I also don’t use autoformatters because I will often disagree with their opinions in specific cases.
For stuff I’m working on with others, I’ll act more like a normal person, though I will still prefer to drop at least , and I’ve never worked with anyone that wanted to put trailing slashes on void elements (and haven’t ever used Prettier on HTML, evidently).
As for Prettier putting the trailing slash in: huh, that’s a really weird decision (and no flag for it!), given that they’re not emitting valid XML (not escaping >, at the least), so it’s just the personal preference thing, for something that was just added as an XHTML compatibility mechanism.
Re: How to win at CORS
#20How they jump into the article without explaining or even expanding what the CORS acronym stands for.
Author here! I added a small reference to the acronym in the article, but I don't think it really matters. I actually forgot what it stands for the other week, but it didn't prevent me understanding it. And relearning the acronym didn't help me understand it more.
Thank you. I was just nitpicking, there.