Re: [w3ctag/design-reviews] "With Credentials" flag possibly inconsistent with web architecture (#76)

> (Note that there is no "don't use credentials" in HTTP, like if you want cookie dropped)

Isn't that entirely left up to the client implementation?

HTTP also allows for a design where you only return a 200 if a secret is given in a request header or even a GET request body (which you cannot emulate in browsers). All of these would fall flat with "follow your nose".

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/design-reviews/issues/76#issuecomment-359395888