[whatwg/fetch] A cross-origin to same-origin redirect should not result in an opaque response (#357)

Although technically this could lead to exfiltration, that is already possible through `<iframe>`. So the protection the standard has is largely theoretical, moot in practice, and not implemented in browsers.

Since request's origin is only reset during redirects for CORS, fixing this shouldn't be too tricky. Need to decide whether to simply set response tainting to basic or move to a different concept altogether.

---
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/357