Re: [ServiceWorker] window.fetch (#581)

@annevk Right...

We're discussing this a little with our security team. As you said, @mikewest et. al are working on local/intra IP detection (http://crbug.com/378566). But it seems we're not so close to finish the work.

So, to address the issue temporarily, I think we have two options for window:

- a) Disallow construction of a Request with RequestInit.mode == no-cors
- b) Make fetch() fulfill the returned Promise even for network error && disable Response.type attribute

Only (b) works for SW. We need to dispatch no-cors requests coming from the page. It's critical.

---
Reply to this email directly or view it on GitHub:
https://github.com/slightlyoff/ServiceWorker/issues/581#issuecomment-70788432