Re: [whatwg/fetch] From-Origin (#687)

AIUI, same-site cookies is not checking the scheme.
If we summarize, the ideal same-site behavior would be:
1. Fail CORP same-site check in case of a HTTPS resource fetched from an HTTP context.
2. Succeed CORP same-site check in case of a HTTP resource fetched from an HTTPS context.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/687#issuecomment-394106967