From 91c795a3f51f636157503ed08050a1a7d4d940da Mon Sep 17 00:00:00 2001 From: Tom Dykstra Date: Sat, 21 Sep 2024 16:03:26 -0700 Subject: [PATCH] Fix links (#33672) * Fix links Fixes #33661 * Fix links * Fix links The reader would be better served by an internet search if they wanted more info about author request headers. --- aspnetcore/security/cors.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/aspnetcore/security/cors.md b/aspnetcore/security/cors.md index a9283547be..9bd75dfd88 100644 --- a/aspnetcore/security/cors.md +++ b/aspnetcore/security/cors.md @@ -220,11 +220,11 @@ This section describes the various options that can be set in a CORS policy: ### Set the allowed request headers -To allow specific headers to be sent in a CORS request, called [author request headers](https://xhr.spec.whatwg.org/#request), call and specify the allowed headers: +To allow specific headers to be sent in a CORS request, called *author request headers*, call and specify the allowed headers: [!code-csharp[](~/security/cors/8.0sample/Cors/Web2API/Program.cs?name=snippet_sa)] -To allow all [author request headers](https://www.w3.org/TR/cors/#author-request-headers), call : +To allow all author request headers, call : [!code-csharp[](~/security/cors/8.0sample/Cors/Web2API/Program.cs?name=snippet_aah)] @@ -321,7 +321,7 @@ For some CORS requests, the browser sends an additional [OPTIONS](https://develo * `multipart/form-data` * `text/plain` -The rule on request headers set for the client request applies to headers that the app sets by calling `setRequestHeader` on the `XMLHttpRequest` object. The CORS specification calls these headers [author request headers](https://www.w3.org/TR/cors/#author-request-headers). The rule doesn't apply to headers the browser can set, such as `User-Agent`, `Host`, or `Content-Length`. +The rule on request headers set for the client request applies to headers that the app sets by calling `setRequestHeader` on the `XMLHttpRequest` object. The CORS specification calls these headers *author request headers*. The rule doesn't apply to headers the browser can set, such as `User-Agent`, `Host`, or `Content-Length`. > [!NOTE] > This article contains URLs created by deploying the [sample code](https://github.com/dotnet/AspNetCore.Docs/tree/live/aspnetcore/security/cors/8.0sample/Cors) to two Azure web sites, `https://cors3.azurewebsites.net` and `https://cors.azurewebsites.net`. @@ -373,7 +373,7 @@ To allow specific headers, call : +To allow all author request headers, call : [!code-csharp[](~/security/cors/8.0sample/Cors/Web2API/Program.cs?name=snippet_aah2)]