mirror of
https://repo.dactyloidae.xyz/Dactyloidae/UXP.git
synced 2026-08-15 08:53:07 +09:00
96d1e2766f
The Authorization header with a JSON Web Token (JWT) can be sent via XMLHttpRequest without explicit authorization via Access-Control headers. According to the spec, this must always explicitly be mentioned in ACAH request headers and isn't allowed to be wildcarded. However, nobody currently obeys this rule and many websites are misconfigured because Chromium and Firefox always allowed it. This patch adds the more stricter code but keeps it behind an #ifdef 0 to be released later on if and when there is enough consensus on the web to obey this spec. This patch explicitly avoids the added complexity Mozilla added to educate web devs since our role in that respect is not significant. it's not preffed and it won't throw an explicit deprecation warning. See Mozilla bugs 1687364 and 1841019. |
||
|---|---|---|
| .. | ||
| base | ||
| build | ||
| cache | ||
| cache2 | ||
| cookie | ||
| dns | ||
| ipc | ||
| locales | ||
| mime | ||
| protocol | ||
| sctp | ||
| socket | ||
| srtp | ||
| standalone | ||
| streamconv | ||
| system | ||
| test | ||
| wifi | ||
| moz.build | ||
| necko-config.h.in | ||