Why does the CORS specification not allow redirection?

Question

The W3C CORS spec clearly states in step 2:

If the response contains an HTTP status code of 301, 302, 303, 307, or 308

 Apply the cache and network error steps.

I think this measure has been added to mitigate security risks. However, I cannot find a source detailing exactly what the consequences will be of providing redirect permissions.

---

Questions on how to work around this issue have been asked before . I am looking for an explanation of why this proposal is included in the specification in the first place, for example, the following questions:

CORS - What is the motivation for implementing pre-flight requests?

Why does a HEAD request for cross origin need to be checked beforehand?

Answer 1

WHATWG:

, . , - , , .