Re: [whatwg/fetch] Response filter escalation (#535)

Doesn't it also mean that header information (and possibly authentication information) would be exposed for those cross-origin requests?

For context: Firefox currently un-wraps the response and re-wraps according to the "outer" request's tainting. Chromium follows the letter of the specification. I wrote a demonstration test here:

https://github.com/w3c/web-platform-tests/compare/master...bocoup:fetch-filtering-escalation-demo

I haven't determined whether Firefox observes any sort of filter "precedence", or if it consistently re-wraps.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/535#issuecomment-298712333