1

My first question comes from this mdn article on request mode, which says If not defined, the default value of no-cors is assumed. However, in its attached example is this snippet:

var myRequest = new Request('flowers.jpg');
var myMode = myRequest.mode; // returns "cors" by default

So what is the right default mode?

My second question is, why resource request via <link href="xxx"> got a no-cors response type?

sideshowbarker
  • 81,827
  • 26
  • 193
  • 197
Blake
  • 7,367
  • 19
  • 54
  • 80
  • The answer is about what’s the default is… it depends. See https://fetch.spec.whatwg.org/#concept-request-mode which says, *A request has an associated mode, which is "same-origin", "cors", "no-cors", "navigate", or "websocket". Unless stated otherwise, it is "no-cors".* However, browsers can (re)set the actual mode something else depending on what kind of request it is. For example, if a request is a *cross-origin* request initiated from a Fetch/XHR/Ajax call, then per other requirements in the Fetch spec, the browser sets the mode to "cors" — and adds the Origin header to the request. – sideshowbarker Sep 26 '18 at 04:12
  • As far as why a request initiated from `` is "no-cors": per requirements in the HTML spec, those requests never set the mode to any value. So the request gets made with the default "no-cors" — and no Origin header. Basically, spec-wise, different specs reference/call algorithms in the Fetch spec but with different settings. That’s why at https://fetch.spec.whatwg.org/#ref-for-concept-request-mode the spec has a note saying, *Even though the default request mode is "no-cors", standards are highly discouraged from using it for new features. It is rather unsafe.* – sideshowbarker Sep 26 '18 at 04:18
  • And as far as the comment in the `var myRequest = new Request('flowers.jpg'); var myMode = myRequest.mode;` code snippet in MDN, it’s correct. That’s the behavior of the Request() constructor. See the part of the algorithm at https://fetch.spec.whatwg.org/#dom-request where it says, *Set fallbackMode to "cors"*. But it’s important to note that’s just the behavior for the Request() constructor, and it’s not the behavior for a request initiated from, e.g., `` — which doesn’t use the Request() constructor. – sideshowbarker Sep 26 '18 at 04:32
  • See the answer at https://stackoverflow.com/questions/44121783/fetch-api-default-cross-origin-behavior/44125919#44125919 for a somewhat-related explanation – sideshowbarker Sep 26 '18 at 04:44

0 Answers0