Re: [whatwg/fetch] CORB: empty response VS erroring out (#727)

> The question is, this is an acceptable data leak?

It seems like the data you can infer from the error is fairly narrow: "This resource had an interesting MIME type." Are there cases where that's revealing more than we'd like?

Also: if we expand the conditions under which we return a network error (e.g. by making that `From-Origin`'s behavior as well), then we further reduce the granularity of the assumptions an attacker can make.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/727#issuecomment-390912392