- From: Anne van Kesteren <notifications@github.com>
- Date: Thu, 24 May 2018 04:22:45 -0700
- To: whatwg/fetch <fetch@noreply.github.com>
- Cc: Subscribed <subscribed@noreply.github.com>
Received on Thursday, 24 May 2018 11:23:07 UTC
annevk commented on this pull request. > + + <li> + <p>If <var>request</var>'s <a for=request>origin</a> is <a>same origin</a> with + <var>request</var>'s <a for=request>current url</a>'s <a for=url>origin</a>, then return + <b>allowed</b>. + + <p class=note>A cross-origin response redirecting to a same or same-site resource with the + `<a http-header><code>Cross-Origin-Resource-Policy</code></a>` header specified does not affect + anything. + <!-- We could make this have an effect if we fix https://github.com/whatwg/fetch/pull/594 first, + but even then we normally do not let this have any effect for "no-cors" so it would be + somewhat inconsistent if it did here, but might still be better... --> + + <li><p>Let <var>policy</var> be the <a>combined value</a> with + `<a http-header><code>Cross-Origin-Resource-Policy</code></a>` and <var>response</var>'s + <a for=response>header list</a>. Yeah, that's the intent. Perhaps we should split on `,` though given that it seems likely we'll add support for multiple explicit origins later. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/whatwg/fetch/pull/733#discussion_r190550956
Received on Thursday, 24 May 2018 11:23:07 UTC