Merge pull request #139 from decentralized-identity/brianorwhatever-p…

…atch-2 Add CORS details
decentralized-identity · Nov 29, 2024 · 40762a1 · 40762a1
2 parents 25d3ab1 + 42a3d5f
commit 40762a1
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/spec/security_and_privacy.md b/spec/security_and_privacy.md
@@ -40,3 +40,9 @@ See also:
 
 - [UTS-46](https://unicode.org/reports/tr46/)
 - [[spec:RFC5895]]
+
+### Cross-Origin Resource Sharing (CORS) Policy Considerations
+
+To support scenarios where DID resolution is performed by client applications running in a web browser, the file served for the [[ref: DID Log]] needs to be accessible by any origin. To enable this, the [[ref: DID Log]] HTTP response MUST include the following header:
+
+`Access-Control-Allow-Origin: *`