17042 2012-05-13 09:02:06 +0000 Last-Event-ID is not a simple header 2013-10-28 14:19:28 +0000 1 1 1 Unclassified WebAppsSec CORS unspecified PC Windows XP RESOLVED INVALID P2 normal --- 1 vic99999 annevk mike public-webapps public-webappsec vic99999 dave.null oldest_to_newest 67636 0 vic99999 2012-05-13 09:02:06 +0000 Server-sent-events use this header with CORS http://www.w3.org/TR/eventsource/#last-event-id 67637 1 annevk 2012-05-13 10:12:25 +0000 More importantly, it's not an author request header. 67714 2 vic99999 2012-05-15 10:37:06 +0000 @Anne, LOL!!! thank you for your understanding you just stop polyfilling Server sent events with XMLHttpRequest 67715 3 annevk 2012-05-15 10:39:48 +0000 Ah yes, that would indeed not work without a preflight request. Is that a big problem? 67716 4 annevk 2012-05-15 10:40:31 +0000 Also, at this time it seems easier to get browsers to add EventSource support than to change their CORS implementations yet again. 67717 5 vic99999 2012-05-15 10:46:22 +0000 + Last-Event-ID can be setted with help of EventSource, than disconnect + redirect can be done to make request with "Last-Event-ID" header to some other site. 67721 6 vic99999 2012-05-15 10:52:53 +0000 or may be it is time to drop Server sent events... and move to WebSockets 67724 7 annevk 2012-05-15 10:59:24 +0000 I don't understand comment 5. WebSocket is great, but quite different from EventSource and EventSource is not going away at this point. 67732 8 vic99999 2012-05-15 11:32:37 +0000 comment #5: EventSource allows to make requests with "Last-Event-ID" header without preflight. 91877 9 vic99999 2013-08-12 05:22:22 +0000 https://github.com/mozilla/releases-mozilla-central/blob/master/content/base/src/nsXMLHttpRequest.cpp#L3037 91896 10 annevk 2013-08-12 13:47:59 +0000 That seems like a bug in Gecko to me. We also instruct the browser to set Referer and Origin to certain values. They're not simple either. 95434 11 annevk 2013-10-28 14:19:28 +0000 *** Bug 19315 has been marked as a duplicate of this bug. ***