CORS requests fail with Access-Control-Allow-Origin: *

[thatsmydoing]

mithril sets withCredentials to true when making XHR requests. Chrome and Firefox disallow CORS requests with credentials if the allow origin is *.

Is there any reason it's set to true instead of being configurable?

[lhorie]

Hmm, I had it set to true with authentication-walled APIs in mind (which is my main use case), but for public APIs, you're right, it's not a good default. Now that I think about it, public APIs are probably more common, so I'll consider this is a bug.

In any case, the flag is configurable via m.request's config option:

var publicAPI = function(xhr) {xhr.withCredentials = false;}

m.request({
  method: "GET",
  url: "/",
  config: publicAPI
});

[lhorie]

Default value for xhr.withCredentials is changed from true to default (i.e. false) in the origin/next branch and is scheduled to be released in v0.1.1