Re: [whatwg/fetch] Split 'document' destination into 'frame' and 'iframe'. (#948)

> on its way out

In a year. Probably. :) It seems to me that while it's a thing that's possible, marking the outgoing request as `no-cors` is safer than marking it as `navigate`. After 2020, when we're sure that requests are going to spin up browsing contexts because we've finally gotten rid of Flash, it seems pretty reasonable to revisit this mechanism?

Honestly, I don't have strong opinions about this either way, and I'm pretty sure that @arturjanc has the same take; Google servers will know to look at `sec-fetch-dest` and evaluate the risk accordingly. We can add a note in the spec to that effect and hope other folks pay attention as well. I think it would be helpful to developers to distinguish the request that might or might not create a browsing context from requests that will definitely land in a browsing context, but I also think that it's not a distinction I'm going to jump up and down and insist upon. :)

I think we've played out the arguments here pretty well: what would you like to see happen, @annevk? I'll defer to you for a decision here. `navigate` everywhere for `<embed>` and `<object>`?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/948#issuecomment-547787568