Re: [ServiceWorker] window.fetch (#581)

Hmm, it seems that by using `RequestInit.mode=="no-cors"` and looking at the `type` on the returned `Response`, we can determine whether a certain host exists && is_serving_HTTP. Shouldn't this be considered as a way for port scanning?

Make a cross-origin request using `fetch()` from origin X to Y.
- If Y points at a working web server, the result would be "opaque"
- If not, the result would be "error". I.e. the Promise would be rejected

Cf. the WebSocket API not returning details of opening handshake. See the big red warning in https://html.spec.whatwg.org/multipage/comms.html#feedback-from-the-protocol

/cc @horo-t

---
Reply to this email directly or view it on GitHub:
https://github.com/slightlyoff/ServiceWorker/issues/581#issuecomment-70056571