Clojurians Log v2

That talk was very useful. The intuition about the CORS restrictions is that you can do from JS (XHR etc) whatever was possible to do with plain HTML. You could always make a form which makes a POST to any random server, and thus you can do the same with XHR with no restrictions. This is the so-called “simple” request. You have to use that form encoding because this is what the plain HTML approach uses.

Ah, where you don't control the server you're POSTing to... OK, that makes sense... but then you don't have any control over whether that server supports CORS...?

Exactly, for servers you don’t control (or if you want to expose your API to third parties, I guess), simple requests are allowed by the browser without preflight.

I think though that modern browsers can even restrict those simple requests if the server opts in.

There’s a ton of info in the talk

> Is he talking about? application/x-www-form-urlencoded as in, that doesn't require a preflight request?

which is this... https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests

I don't think he's saying that it avoids a CORS request, just that it makes life simpler.

(but, I'll be honest, I've no idea why a POST with form-urlencoded is any easier/better than with application/json!)