Re: [whatwg/fetch] CORB: nosniff handling (#686)

@anforowicz 

I think we should avoid referencing the request here, else it suggests a different kind of request could bring the data into the same process. I believe checking the response is opaque is enough (@annevk can confirm).

> I wasn't sure how to detect range responses.

We detect redirects using status code, so that should be good enough unless there are problems in the wild.

@annevk 

> What is the observable difference between an empty response and a response with some headers filtered and its body omitted?

We would react with a network error, except a network error leaks too much about the other origin. Therefore I think a filtered response is risky vs an empty response.


-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/686#issuecomment-382943426