Re: Origin and Referrer Policy

On Wed, Jul 10, 2019 at 6:10 PM Francois Marier <francois@brave.com> wrote:

> On 2019-07-03 04:34, Anne van Kesteren wrote:
> > I wanted to bring https://github.com/whatwg/fetch/pull/908 to your
> attention
>
> The first part of this change makes sense to me: we should ensure that
> the Origin header does not leak more information than the Referer.
>

Yes, but note that PR only applies to NON-cors requests. For CORS requests
that spec will send the Origin: even if the ReferrerPolicy is no-referrer.
I personally (chair hat definitely off!) disagree and think it should send
null in the no-referrer case. CORS does this for cross-origin redirects so
the servers already have to handle that case.

-Dan Veditz