1052423 - Prevent XMLHttpRequests with methods except for GET, HEAD or OPTIONS in prerendered documents

Status: NEW

(Core :: DOM: Core & HTML, defect, P5)

Description

[(no longer active)]

POST specifically would be super dangerous...

Comment 1

[Alex Vincent [:WeirdAl]]

Why in the world should we do this to POST?  

(1) There's been no mention of this that I'm aware of in the whatwg mailing lists.  
(2) Are you thinking this should be for content-only, or are you thinking of whacking privileged code support for this as well?
(3) Is it because multipart/form-data is hard to get right?  That might be an issue for file uploads (which is a whole different story) or large fields of data, but x-www-form-urlencoded works fine most of the time.
(4) XHR POST has been there from the very beginning; it's why XHR.send() takes an argument, for the body of the request.  This would be a major change away from the standard.

Comment 2

[(no longer active)]

(In reply to Alex Vincent [:WeirdAl] from comment #1)
> Why in the world should we do this to POST?  

Sorry incomplete bug title.

Comment 3

[Firefox Bug Husbandry Bot]

https://bugzilla.mozilla.org/show_bug.cgi?id=1472046

Move all DOM bugs that haven't been updated in more than 3 years and has no one currently assigned to P5.

If you have questions, please contact :mdaly.