| 11:23 | <MikeSmith> | annevk: maybe it’s time to lock https://github.com/whatwg/xhr/issues/20 (Abandon hope of removing sync XHR from the web platform?) from further comments |
| 11:23 | <MikeSmith> | it is hard to imagine anybody coming along with new information to add as a comment there |
| 11:26 | <MikeSmith> | but it’s easy to imagine N more commentors showing up to repeat the same subjective argument that others there have already said |
| 11:57 | <annevk> | MikeSmith: feel free |
| 12:08 | <MikeSmith> | annevk: OK, done |
| 12:10 | <MikeSmith> | annevk: btw about CORS questions on Stack Overflow, one of the most-common questions by far is the case where the OP has gotten a 4xx or 5xx response but thinks they have a CORS problem due to the fact that browser reports the response as lacking the Access-Control-Allow-Origin header |
| 12:11 | <MikeSmith> | I don’t know how to prevent that but I wonder if you’d thought about it all |
| 12:12 | <MikeSmith> | obviously one way would be for browsers to not report any CORS-related errors in the devtools console for 4xx and 5xx responses |
| 12:12 | <annevk> | I don’t think too much about CORS, but devtools would reveal this pretty quickly? |
| 12:12 | <annevk> | Well that’d be bad, since it is a CORS error |
| 12:12 | <MikeSmith> | devs don’t seem to be able to figure it out on their |
| 12:13 | <MikeSmith> | right sure it would be bad |
| 12:13 | <MikeSmith> | just saying outside of suppressing the error, I don’t have good ideas |
| 12:13 | <annevk> | Devtools could be more explicit perhaps |
| 12:14 | <MikeSmith> | yeah maybe I’ll raise some browser issues for it |
| 12:14 | <annevk> | Your server returned a 410 without ACAO header |
| 12:14 | <MikeSmith> | yeah something more like that maybe |
| 12:14 | <MikeSmith> | anyway, see https://stackoverflow.com/questions/54795541/503-return-from-server-is-branded-as-cors-violation-by-chrome for an meta-report about it at SO |
| 12:15 | <MikeSmith> | > The reason this is bad is because it misled our developers and wasted some time hunting down a CORS problem that wasn't really there. |
| 12:16 | <MikeSmith> | it is not uncommon to see reports on SO from people who say they have literally spent hours trying to figure out what was wrong with their CORS config, when it turns out they never had CORS-config problem at all but instead a 4xx or 5xx problem |
| 12:17 | <annevk> | Hmm but the tools clearly say it’s 5xx |
| 12:18 | <MikeSmith> | yeah I know but they still often miss it |
| 12:18 | <MikeSmith> | or they don’t understand that is the real problem |
| 12:18 | <MikeSmith> | ..or they think their CORS config has caused the 4xx or 5xx error |
| 12:18 | <annevk> | The problem with fixing it the way you suggest is that some might try to expose that error to content |
| 12:19 | <MikeSmith> | yeah |