w3:
6.2 Cross-Origin Resources and CORS¶
Applications tend to cache items that come from a CDN or other origin. It is possible to request
The mode
of a Request
(allegedly) defaults to "no-cors". (I say "allegedly" because I believe I've seen situations in which an implicitly created Request
used in fetch()
results in a CORS-enabled Response
.)
So you should be explicit about opting in to CORS if you know that your server supports it:
var corsRequest = new Request(url, {mode: 'cors'});
fetch(corsRequest).then(response => ...); // response won't be opaque.
Given a properly configured remote server, a CORS-enabled Request
will result in a Response
that has a type of "cors". Unlike an "opaque"
Response
, a "cors"
Response
will expose the underlying status
, body
, etc.
Unfortunately, there's no way to detect it.
For security reasons, it's explicitly not allowed: https://github.com/whatwg/fetch/issues/14.