Change Details

Mediawiki core should allow the `Access-Control-Max-Age` header in Cross-origin resource sharing (CORS) api requests. Use case: {T268267} - cache the result of OPTIONS api calls to avoid needing to make a new CORS preflight request before each api call to each wiki. Tagging #security-team per @Legoktm's suggestion at T268267#6674947 - is this okay from a security perspective? See also: {T76701} {T76340}

Mediawiki core should allow the `Access-Control-Max-Age` header in Cross-origin resource sharing (CORS) api requests. Use case: {T268267} - cache the result of OPTIONS api calls to avoid needing to make a new CORS preflight request before each api call to each wiki. Tagging #security-team per @Legoktm's suggestion at T268267#6674947 - is this okay from a security perspective? See also: * {T76701} * {T76340} * https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Max-Age * https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#Examples_of_access_control_scenarios

Mediawiki core should allow the `Access-Control-Max-Age` header in Cross-origin resource sharing (CORS) api requests. Use case: {T268267} - cache the result of OPTIONS api calls to avoid needing to make a new CORS preflight request before each api call to each wiki. Tagging #security-team per @Legoktm's suggestion at T268267#6674947 - is this okay from a security perspective? See also: {T76701}* {T76701} * {T76340} * https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Max-Age * https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#Examples_of_access_control_scenarios {T76340}