Application/json connection concerns

[patmmccann]

#8498 indicates ajax type application/json causes performance issues. A quick search indicates it is used widely in the project. Should this be remedied?

[patmmccann]

It appears https://stackoverflow.com/questions/56812188/how-to-specify-application-json-content-type-without-invoking-chromes-cors-pr suggests 'text/plain'

[patmmccann]

Prebid.js/modules/yahoosspBidAdapter.js

Line 544 in 62da3ac

contentType: 'application/json',

as an example

[dgirardi]

I prefer MDN as a resource to understand when CORS preflights are not triggered: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests

In general I don't think Prebid itself can act on this besides maybe issuing a recommendation to the adapters, because their backend may need work to accept "simple" requests. For example, if I am reading that spec right, any adapter that uses Cookie (called withCredentials in ajax) would need to rewrite their backend to take in that data from somewhere else. (even just a Content-Type change may trip up their backend).

[patmmccann]

@ChrisHuie could you add a pr to the bidder page to https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests to raise awareness?

[patmmccann]

@dgirardi by way of example, this fastlane request contained no preflight

while these yahoo ones do

[dgirardi]

@patmmccann, you are right, I was mistaken about withCredentials. Although I think - with the risk of misunderstanding the spec again - that more than 128 bytes in the Cookie header would still trigger it.

I'm still of the opinion that this cannot/should not be reduced to the content-type (some adapters rely on custom headers for example). Each SSP should decide to make "simple" requests a goal and perform their own testing.

[patmmccann]

@ChrisHuie any update? would love to close this out

[ChrisHuie]

@ChrisHuie any update? would love to close this out

I will get this in this week

[bretg]

closing this - tracked now by the docs PR