Android: Credentials always sent with CORS requests?
When sending CORS requests (XHR API), the credentials should not be sent implicitly 开发者_运维百科(W3C spec). This should only when the option withCredentials is set to true.
Apparently Android does not take this rule into account?
An example CORS system can be found here. This example seems to work for Mozilla (Firefox & Fennec), Google Chrome and Safari, but not for the Android browser.
Can anyone confirm this flaw?
Grtz, Maarten
精彩评论