[whatwg/fetch] Document same-origin policy more centrally (#691)

@ricea asked in #144 that the analysis @jakearchibald made in https://github.com/whatwg/fetch/issues/144#issuecomment-368040980 about range requests versus the same-origin policy really deserves to be detailed somewhere more officially.

That made me think that perhaps we should have a section detailing the same-origin policy and what it means for networking.

The specification already has various bits through that talk about this, e.g., https://fetch.spec.whatwg.org/#cors-protocol-exceptions, but it might make sense to have something more general.

(There's also some other bits we do for security that are not strictly about the same-origin policy, e.g., https://fetch.spec.whatwg.org/#atomic-http-redirect-handling. I'm not sure how to fit those in. Perhaps leaving them standalone is fine.)

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/691