CORS to JSONP - sgml/signature GitHub Wiki

CORS FAQ

1. HTTP OPTIONS Method Troubleshooting

Q1: When does an OPTIONS request appear during a CORS exchange?

It appears whenever the browser performs a preflight for a non‑simple cross‑origin request.

Q2: Where does an OPTIONS request get sent before the actual cross‑origin request?

It is sent to the same URL and origin as the intended request, but with the OPTIONS method.

Q3: When does a server need to respond to OPTIONS for non‑simple requests?

It must respond whenever the browser sends a preflight for methods like PUT, DELETE, PATCH, or custom headers.

Q4: Where do OPTIONS requests commonly fail due to intermediary components?

They commonly fail at reverse proxies, load balancers, and API gateways.

Q5: When should OPTIONS return a success status for preflight handling?

It should return success whenever the browser performs a preflight.

2. Browsers With No OPTIONS Support

Q6: When does Opera Mini skip sending OPTIONS during cross‑origin requests?

It skips OPTIONS whenever a non‑simple request is attempted.

Q7: Where do older Android WebViews fail to emit OPTIONS preflights?

They fail in WebViews prior to Android 4.4.

Q8: When does UC Browser avoid sending OPTIONS for performance reasons?

It avoids OPTIONS during cross‑origin requests that would normally require preflight.

Q9: Where do embedded or IoT browsers omit OPTIONS entirely?

They omit OPTIONS in environments with minimal or non‑standard browser engines.

3. Browsers With Partial or Inconsistent OPTIONS Support

Q10: When does Safari send OPTIONS but apply inconsistent CORS behavior?

It does so during cross‑origin requests involving custom headers or non‑simple methods.

Q11: Where does Mobile Safari intermittently skip OPTIONS under resource pressure?

It skips OPTIONS during low‑memory conditions or backgrounded page states.

Q12: When does Chrome on iOS behave differently due to WebKit’s CORS implementation?

It behaves differently whenever a preflight is required, because Chrome iOS uses WebKit.

Q13: Where does Samsung Internet send OPTIONS inconsistently for background requests?

It does so during background fetches or service‑worker‑related operations.

Q14: When does EdgeHTML mishandle credentialed OPTIONS preflights?

It mishandles them during cross‑origin requests that include cookies or authorization headers.

Separate FAQ: Where to Find Reference Documentation

Test URLs

| REST API          | Description                                                                                  | Documentation Link                                                                                                   |
|-------------------|----------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------|
| Wikipedia API     | Supports JSONP callbacks, allowing you to fetch data from Wikipedia and wrap it in a callback function. | [Wikipedia API Documentation](https://www.mediawiki.org/wiki/API:Main_page)                                          |
| GitHub API        | Supports JSONP for cross-origin requests by sending a `callback` parameter with GET calls.     | [GitHub API Documentation](https://docs.github.com/en/[email protected]/rest/using-the-rest-api/using-cors-and-jsonp-to-make-cross-origin-requests)   |
| dotCMS API        | Supports JSONP for cross-domain calls by adding a `callback` parameter to the RESTful URL request. | [dotCMS API Documentation](https://docs.dotcms.com/docs/latest/docs/latest/content-api-jsonp)                        |

Security Testing Projects

https://0x1.gitlab.io/web-security/JSONBee/

Mediawiki

var apiEndpoint = "https://commons.wikimedia.org/w/api.php";
var params = "action=query&list=allimages&ailimit=3&format=json&callback=foo";
var script = document.createElement('script');
script.src = apiEndpoint + "?" + params;
document.body.appendChild(script);
script.onload = function() {
  document.body.removeChild(script);
};
script.onerror = function(error) {
  console.error('Error fetching data:', error);
  document.body.removeChild(script);
};

References

Troubleshooting

CORS

Github Issues

Same-origin policy and Cross-origin resource sharing (CORS) #80 - ajhsu/blog
Disable same origin policy #566 - responsively-org/responsively-app
[css-images] image-orientation:none violates same-origin policy #5165 - w3c/csswg-drafts