Re: [whatwg/fetch] consider failing same-origin fetch requests that get a cross-origin cors Response synthesized by a service worker (#629)

Also I would point out the part that is appealing to security team here is the exact behavior we do for this case in SW:

```js
evt.respondWith(async function() {
  let corsResponse = await fetch(crossOriginURL, { mode: 'cors' });
  let syntheticResponse = new Response(corsResponse.body);
  return syntheticResponse;
}());
```

A cross-origin body is returned but the outer Response ends up with the Request.url.  Are you really arguing that is unsafe @annevk?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/629#issuecomment-342937395