Re: [whatwg/fetch] CH processing, cross-origin redirects and service workers (#800)

I agree with @annevk's comment in https://github.com/whatwg/fetch/issues/800#issuecomment-415774670. 

When it comes to the level of badness of sending CH on cross-origin redirects, I'd rather this didn't happen, but I expect it's not a huge risk. The threat model in this case is accidentally disclosing CH information to third parties, and the 1p -> 3p redirect pattern doesn't seem very common, so the leakage potential is low. Still, I expect this to be moot because -- as Ilya said -- Feature Policy should disable the feature when it sees a redirect to a non-safelisted origin (similarly to how CSP rejects resource loads from outside of its safelist upon redirects).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/800#issuecomment-416069481