I thought same origin implies no CORS, and vice-versa. What's the difference between the two options for JavaScript's Fetch API's mode option?
Also, in the specs, it says:
Even though the default request mode is "no-cors", standards are highly discouraged from using it for new features. It is rather unsafe.
Why is it unsafe? Source:
I thought same origin implies no CORS, and vice-versa. What's the difference between the two options for JavaScript's Fetch API's mode option?
Also, in the specs, it says:
Even though the default request mode is "no-cors", standards are highly discouraged from using it for new features. It is rather unsafe.
Why is it unsafe? Source: https://fetch.spec.whatwg/#requests
Share Improve this question edited Mar 10, 2016 at 8:41 Bergi 665k161 gold badges1k silver badges1.5k bronze badges asked Mar 10, 2016 at 8:04 Leo JiangLeo Jiang 26.1k58 gold badges176 silver badges327 bronze badges1 Answer
Reset to default 16With same-origin you can perform requests only to your origin, otherwise the request will result in an error.
With no-cors, you can perform requests to other origins, even if they don't set the required CORS headers, but you'll get an opaque response.
You can read more on MDN: https://developer.mozilla/en-US/docs/Web/API/Request/mode and https://developer.mozilla/en-US/docs/Web/API/Response/type.