- From: Anne van Kesteren <notifications@github.com>
- Date: Tue, 10 Apr 2018 00:13:18 -0700
- To: whatwg/fetch <fetch@noreply.github.com>
- Cc: Subscribed <subscribed@noreply.github.com>
Received on Tuesday, 10 April 2018 07:13:45 UTC
I think I'd be somewhat supportive of something like `Sec-Site` with `same-origin`/`same`/`cross` as values. Generalizing `Origin` would indeed undo a lot of referrer protection that I'm not super comfortable with. Making it opt-in seems nice, but that also means we cannot realistically deploy it soon, since I'd assume we'd want to wait for origin manifests to become a thing. The cost of adding `From-Origin` on the other hand seems fairly low and something we could implement pretty quickly allowing particularly sensitive resources to deploy protection soonish. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/whatwg/fetch/issues/687#issuecomment-379998257
Received on Tuesday, 10 April 2018 07:13:45 UTC