Re: [whatwg/fetch] Status code to use in a response indicating rejection of a cross-origin access (#172)

@timbl Yes; 403 can be generated by any server, not just the origin, and effectively Fetch is acting as a server in this case because it's generating a response (or it would be if that were what was being discussed, but I misunderstood it).

Debugging information / context is best to put into headers or the body (although, as always, it's important to be careful about how much of such information is exposed to a possible attacker).

---
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/172#issuecomment-237034706