CORS integration

[annevk]

Do these new request headers go across the origin boundary? What's the CORS story?

[kmonsen]

Thank you for the feedback!

The headers will only be sent on to the registration/refresh endpoints. These are set up during the registration, but can be changed during refreshes.

The refresh endpoint has to be samesite, or sharing eTLD+1, with the session, so it will only be sent to the same eTLD+1. There is another restriction, if you you try to set up a session on a parent domain there needs to be a /.well-known/ to say this is OK.

One thing to note is that the user agent will follow redirects on the requests, and they could go everywhere.

Happy to restrict these a bit more if you think that makes sense.