Re: [whatwg/fetch] Proposal: `Sec-Site` should capture information about the requester of a resource (#700)

I think this is a good direction to explore, allowing a developer to make granular decisions about ACLs for particular resources/requests based on its initiator. I think I agree with the advantages @arturjanc posits, and I also agree with his analysis of the Referrer Policy integration. I'd go further than @arturjanc, actually, and suggest that `same-origin`/`same-site`/`cross-site` is coarse-enough that we'd be able to justify sending it even in the presence of `no-referrer`, which would mitigate the risk of "breaking" sites that relied on a requester revealing something about itself in order to service a given request.

Before diving too deeply into details (and I'd add redirect behavior to the list of @arturjanc's questions), I'd be curious about the rest of @whatwg/security's opinion on the proposal more generally. It seems pretty reasonable to me, and worth the time to sketch out.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/700#issuecomment-381498738