Re: [whatwg/fetch] Should we send an Origin header for no-cors fetches? (#225)

>From the Bugzilla bug it seems that @fmarier considers this worth doing despite `Origin` no longer being useful to tell "cors" from "no-cors" requests.

I'd rather we just recommend same-site cookies as anti-CSRF and keep `Origin` for CORS, but with Chrome already shipping the semantics from https://github.com/whatwg/fetch/issues/225#issuecomment-238874536 and @fmarier interested in aligning I'm no longer super interested in fighting for that.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/225#issuecomment-263267573