Re: [whatwg/fetch] Cross-Origin Read Blocking (CORB) (#681)

As @anforowicz mentions, CORS and CORB apply to a document's subresource requests, but not to iframes.  In your example, visa.com can load https://secure.com's text/html response in an iframe without being blocked by either CORS or CORB.  It cannot use fetch or XHR to get https://secure.com's text/html response without an Access-Control-Allow-Origin header.  Also, if foo.com tried to request the URL via an img or script tag, CORB would filter the response (though it wouldn't have been usable in those contexts anyway).

As for the proxying question, foo.com could indeed proxy data from bar.com, but this isn't a security risk to the user because the request to bar.com won't have the user's cookies or other credentials if it's being made from foo.com's server.  There's no need to use this proxying for iframes.  (Most ads load in iframes, giving them access to whatever data they need from their own origin.)

Hope that clarifies things.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/681#issuecomment-445412039