- From: Anne van Kesteren <notifications@github.com>
- Date: Mon, 11 Nov 2019 05:44:34 -0800
- To: whatwg/fetch <fetch@noreply.github.com>
- Cc: Subscribed <subscribed@noreply.github.com>
Received on Monday, 11 November 2019 13:44:36 UTC
Honoring `X-Frame-Options` (and friend) consistently for `embed` and `object` seems good. Could Chrome start doing that for plugins? I filed https://bugzilla.mozilla.org/show_bug.cgi?id=1595491 to consider this on Mozilla's side. (As for your point 1, the problem is that it doesn't match your mental model, right? SVG will execute script. It won't when fetched with `<img>`. I wouldn't call that a detail.) -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/whatwg/fetch/pull/948#issuecomment-552451142
Received on Monday, 11 November 2019 13:44:36 UTC