Re: [whatwg/fetch] Should we send an Origin header for no-cors fetches? (#225)

Yes, in some jurisdictions there are restrictions about setting cookies that might be used to track logged-out user behavior.  The entropic cookie one would need to prevent login CSRF looks exactly like a tracking cookie, so being able to get a reliable Origin header on POST helps prevent attacks like the one described at http://sakurity.com/reconnect

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/225#issuecomment-264336206