Encountering an issue with how Safari handles CORS requests. Here's the scenario:
- DomainA hosts a page that sends a XHR request to DomainB (origin header set to DomainA)
- DomainB responds with a 302 redirect to DomainC (origin header set to null, compliant with RFC)
- DomainC returns a 200 response with actual content
This setup works smoothly in Chrome and Firefox, but encounters a failure on Safari.
Without xhr.withCredentials turned on, Safari initiates an OPTIONS preflight request before the actual request to DomainC, which seems unnecessary for simple requests. However, the problem arises after this preflight request when Safari throws an error stating "Cannot make any request from null."
To work around this issue, I can set Access-Control-Allow-Origin to * and omit the Access-Control-Allow-Credentials header, allowing the scenario to function. Nevertheless, this workaround does not align with expected behavior.
Despite having all CORS headers properly configured, setting xhr.withCredentials to true triggers the "Cannot make any request from null" error again, even when attempting wildcarding Access-Control-Allow-Credentials.
Although I believe all CORS headers are correctly set up, feel free to verify me. You can test the example here:
The question remains, is this a bug or am I overlooking something?
Appreciate your insights