Re: [ServiceWorker] spec should be more explicit about accessing internal body on opaque Responses (#710)

> I'm worried about changing opaque responses. I'd appreciate input from security folks since this changes the same-origin policy. I would probably throw for the latter case as I suggested earlier.

Also, I really don't understand the security concerns.  We're already hiding opaque response bodies from script.  All removing the body on HEAD does it further hide the body from the browser.  Removing information seems generally safe.

---
Reply to this email directly or view it on GitHub:
https://github.com/slightlyoff/ServiceWorker/issues/710#issuecomment-194909927