Re: [whatwg/fetch] Vary HTTP cache on credentials mode (#307)

The main invariant we are trying to protect here is that if you load something with credentials that has `Access-Control-Allow-Origin: *` due to navigation or some such, that response does not end up reused by a `fetch()` for the same URL without credentials (because then the CORS check would suddenly pass while it should not).

If the user has multiple identities they are better off using something like https://blog.mozilla.org/tanvi/2016/06/16/contextual-identities-on-the-web/ I think, although offering servers more tools to more cleanly separate identities seems like a useful endeavor as well, but I think that's somewhat separate from this distinction here, which mainly follows from CORS.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/307#issuecomment-282903141