[whatwg/fetch] "no-cors" POST and 307/308 redirects (#593)

We basically want the same behavior as we have with POST for the `Origin` header. From the moment you go across origins a flag is set and then if you cross origins again we set the origin to a unique identifier.

This isn't a problem for POST and 302 or some such as "no-cors" GET never includes an `Origin` header.

See also https://bugs.chromium.org/p/chromium/issues/detail?id=760487.

Related Firefox bug: https://bugzilla.mozilla.org/show_bug.cgi?id=446344.

There's also some issues with Safari here. If someone could write web-platform-tests that'd be great.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/593