Re: [whatwg/fetch] CORB: nosniff handling (#686)

Okay - I made some progress here and pushed out a new iteration of the PR.  It is still a little bit rough around the edges, but I hope that we all agree that the changes are going in the right direction.

Notable open issues:

- I wasn't sure how to detect range responses.  Chromium's implementation looks for "Content-Range" response header so this is what I wrote in the PR, but then I guess I am supposed to also define "Content-Range" header somewhere?  Not sure where (right in the CORb section?) and how (just the name?  ABNF for values?  semantics !?)

- I wasn't sure how to spell out the effect of CORB blocking - I am very open to advice and feedback on how to improve the wording (or references to existing concepts and definitions) here

- Allowing of CORS-allowed responses is described just as the Chromium implementation does it today - by looking at Access-Control-Allow-Origin header.  I hope this is okay (wasn't sure if linking to more core CORS algorithm might be more appropriate).

- I still plan to not touch sniffing in this PR and postpone this until later.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/686#issuecomment-382441388