Re: [fetch] Navigate likely needs to be "no-cors" after all, need to update security checks (#126)

So what I think we should do is that HTML just treats any tainted response as same-origin (that is what happens today and makes sense) and that Fetch blocks opaque responses from the service worker (so that you can't exploit it).

---
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/126#issuecomment-141108327