Re: [whatwg/fetch] Cross-Origin Read Blocking (CORB) (#681)

To the first point, if a browser running on https://foo.com is making a cross origin request to https://bar.com, (and `bar.com` doesn't have acces-control-origin-allow: * headers) that request, would be blocked by cors and subsequently by corb if the response is of type json/html (right?). If https://foo.com makes a request to https://foo.com/api/resource, and foo.com proxies that request to https://bar.com, sending the response back, cors and corb would not block the response (right?) making the response available to read by third party javascript? 

So I guess ad scripts/tags have set the Access-Control-Origin-Header on their side and therefore are not blocked by Corb or Cors? 

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/681#issuecomment-445388142