Reference

Integration checklist

Design-review prompts for “SSE is three lines on the client” reality.

Auth & request shape

• Native EventSource: GET only; no custom headers API (WHATWG #2177).
• Cookies / HTTP auth: same-origin usually fine; cross-origin needs withCredentials: true + CORS credentials.
• Bearer-in-header APIs: use fetch + stream parse (or a library), cookie session for the stream, or short-lived token in URL (prefer not to log tokens).

CORS

• SSE is subject to same-origin / CORS like other fetches.
• Cross-origin: server must allow origin; credentials need Access-Control-Allow-Credentials and a specific origin (not *).

Proxies & buffering

• Response: Content-Type: text/event-stream, Cache-Control: no-cache.
• nginx: disable response buffering for the stream (proxy_buffering off and/or X-Accel-Buffering: no); raise read timeouts.
• Comment heartbeats (~15s) against idle drops (WHATWG authoring notes).

Connection budget

• HTTP/1.1: browsers commonly cap ~6 concurrent connections per origin — each open SSE counts. Multiple tabs can stall the origin (text/plain analysis; WHATWG also warns about per-server limits).
• Prefer HTTP/2+ (multiplexed streams) for SSE-heavy apps; or share one EventSource (e.g. SharedWorker) / avoid one stream per widget.

When to leave native EventSource