Add CORS

features/cors.yml

@@ -0,0 +1,19 @@
+name: CORS
+description: Cross-Origin Resource Sharing is an HTTP-header based mechanism that allows a server to indicate any origins (domain, scheme, or port) other than its own from which a browser should permit loading resources. Also known as CORS.
+spec: https://fetch.spec.whatwg.org/#http-cors-protocol
+group: security
+status:
+  compute_from: http.headers.Access-Control-Allow-Origin
+compat_features:
+  - http.headers.Access-Control-Allow-Credentials
+  - http.headers.Access-Control-Allow-Headers
+  - http.headers.Access-Control-Allow-Headers.authorization_not_covered_by_wildcard
+  - http.headers.Access-Control-Allow-Headers.wildcard
+  - http.headers.Access-Control-Allow-Methods
+  - http.headers.Access-Control-Allow-Methods.wildcard
+  - http.headers.Access-Control-Allow-Origin
+  - http.headers.Access-Control-Expose-Headers
+  - http.headers.Access-Control-Expose-Headers.wildcard
+  - http.headers.Access-Control-Max-Age
+  - http.headers.Access-Control-Request-Headers
+  - http.headers.Access-Control-Request-Method

features/cors.yml.dist

@@ -0,0 +1,67 @@
+# Generated from: cors.yml
+# Do not edit this file by hand. Edit the source file instead!
+
+status:
+  baseline: high
+  baseline_low_date: 2015-07-29
+  baseline_high_date: 2018-01-29
+  support:
+    chrome: "4"
+    chrome_android: "18"
+    edge: "12"
+    firefox: "3.5"
+    firefox_android: "4"
+    safari: "4"
+    safari_ios: "3.2"
+compat_features:
+  # ⬇️ Same status as overall feature ⬇️
+  # baseline: high
+  # baseline_low_date: 2015-07-29
+  # baseline_high_date: 2018-01-29
+  # support:
+  #   chrome: "4"
+  #   chrome_android: "18"
+  #   edge: "12"
+  #   firefox: "3.5"
+  #   firefox_android: "4"
+  #   safari: "4"
+  #   safari_ios: "3.2"
+  - http.headers.Access-Control-Allow-Credentials
+  - http.headers.Access-Control-Allow-Headers
+  - http.headers.Access-Control-Allow-Methods
+  - http.headers.Access-Control-Allow-Origin
+  - http.headers.Access-Control-Expose-Headers
+  - http.headers.Access-Control-Max-Age
+  - http.headers.Access-Control-Request-Headers
+  - http.headers.Access-Control-Request-Method
+
+  # baseline: high
+  # baseline_low_date: 2020-07-28
+  # baseline_high_date: 2023-01-28
+  # support:
+  #   chrome: "63"
+  #   chrome_android: "63"
+  #   edge: "79"
+  #   firefox: "69"
+  #   firefox_android: "79"
+  #   safari: "13"
+  #   safari_ios: "13"
+  - http.headers.Access-Control-Allow-Headers.wildcard
+  - http.headers.Access-Control-Allow-Methods.wildcard
+
+  # baseline: high
+  # baseline_low_date: 2020-07-28
+  # baseline_high_date: 2023-01-28
+  # support:
+  #   chrome: "65"
+  #   chrome_android: "65"
+  #   edge: "79"
+  #   firefox: "69"
+  #   firefox_android: "79"
+  #   safari: "13"
+  #   safari_ios: "13"
+  - http.headers.Access-Control-Expose-Headers.wildcard
+
+  # baseline: false
+  # support: {}
+  - http.headers.Access-Control-Allow-Headers.authorization_not_covered_by_wildcard