Re: [fetch] Question about credentials mode of no-cors mode requests. (#168)

> If my understanding is correct, there is no difference between "same-origin" and "include" when the request mode is "no-cors", because the credentials flag is set in HTTP fetch spec 4.3.

I don't think this is true.  If you are in "no-cors" and cross-origin then the response tainting is opaque.  So you trigger the "or response tainting is opaque" part of the second bullet there.

Not sure on the initial question, though.  Would be nice to hear from @annevk on this.

---
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/168#issuecomment-161660136