Re: [whatwg/fetch] From-Origin (#687)

I think checking all frames is unnecessary. For the same/same-site case, you have to trust that you won't load dangerous third-party iframes anywhere on your site. You can self-enforce this with CSP. For the case where From-Origin specifies other origins, you have to either trust them or assume it's not a Spectre defense and just for purposes like hotlinking prevention.

Another thing to think about: should From-Origin apply to no-credentials requests? Should there be a way to say "it's ok to load my resources cross-origin but not with credentials"?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/687#issuecomment-381756323