Re: [fetch] force-Origin-header flag set for no-cors requests (#91)

Regarding the privacy concern shown by Adam in https://bugs.webkit.org/show_bug.cgi?id=20792, I think it's no problem for same origin requests. XHR originating from site A sent to site A doesn't leak anything to A.

And, we're already sending Origin for cross-origin GET requests.

---
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/91#issuecomment-159189213

Received on Tuesday, 24 November 2015 08:00:14 UTC