Re: [whatwg/fetch] The CSP hooks for `<script src='...' nonce='...'>` are broken. (#269)

And the reason we don't set nonce on request is because we want to do the check for inline and external scripts at the same time?

It seems a little weird that if you can specify a nonce, you can suddenly make cross-origin requests. Isn't that a security issue?

---
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/269#issuecomment-205272257