Can the same-origin request policy be disabled in Microsoft Edge?
The same-origin request policy can be disabled in Chrome using the --disable-web-security
flag and in Internet Explorer by changing the security/zone settings.
Is it possible to temporarily disable the same-origin policy in Microsoft Edge?
NOTE: I'm not interested in answers/comments about why this policy exists, why I shouldn't disable it, how to use CORS headers (access-control-allow-origin and the like). I only want to know if there's a way to disable the policy in Edge like you can in other browsers.
Edge now exposes experimental flags, including CORS functionality. Try typing edge:\\flags
in the address bar, then searching for CORS. Making a change requires restarting the browser.
No. The concept of security zones is completely gone in Edge; it doesn't respect the Internet Options dialog from IE11 either. Edge has no command-line parameters (though it can be launched from the command line either with shell:
followed by its app ID or with microsoft-edge:
followed by the URL). The advanced options don't produce anything useful either.
However, there is a workaround, kind of: Edge has a few Group Policy settings. You can open the Local Group Policy Editor by running gpedit.msc
if you don't have a domain. Navigate to the Configure the Enterprise Mode Site List policy (in Computer Configuration → Administrative Templates → Windows Components → Microsoft Edge). Sites you put in the "URI" box will be automatically opened in Internet Explorer 11 when you navigate to them in Edge. You can then, of course, configure security settings just as before.
This workaround is really quite sad, and I am always disappointed when rewrites of programs are missing huge chunks of configurability. As has been mentioned in the comments, it may be better to adjust (or even intercept and change via proxy, if you have to) the headers on the appropriate pages.