Re: [whatwg/fetch] Define Cross-Origin-Resource-Policy response header (#733)

mikewest commented on this pull request.



> +
+ <li>
+  <p>If <var>request</var>'s <a for=request>origin</a> is <a>same origin</a> with
+  <var>request</var>'s <a for=request>current url</a>'s <a for=url>origin</a>, then return
+  <b>allowed</b>.
+
+  <p class=note>A cross-origin response redirecting to a same or same-site resource with the
+  `<a http-header><code>Cross-Origin-Resource-Policy</code></a>` header specified does not affect
+  anything.
+  <!-- We could make this have an effect if we fix https://github.com/whatwg/fetch/pull/594 first,
+       but even then we normally do not let this have any effect for "no-cors" so it would be
+       somewhat inconsistent if it did here, but might still be better... -->
+
+ <li><p>Let <var>policy</var> be the <a>combined value</a> with
+ `<a http-header><code>Cross-Origin-Resource-Policy</code></a>` and <var>response</var>'s
+ <a for=response>header list</a>.

I don't think it matters in this patch, but I agree that that's probably what we'd want to do in a future patch (e.g. define this as a [structured header list](https://tools.ietf.org/html/draft-ietf-httpbis-header-structure-04#section-4.2) whose members are strings that we parse as origins or something.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/733#discussion_r190558806