Re: [whatwg/fetch] "With Credentials" flag possibly inconsistent with web architecture (#517)

> What I'm saying is that if you set `Access-Control-Allow-Origin: *` in error, but in a way that today does not leak anything, this would leak a bit.

I agree.

> Anyway, past all that, even if everyone was comfortable making that change (it's unclear to me who besides timbl is asking for this)

@slightlyoff asks me about this on a regular basis, and I can believe that it annoys some developers beyond the TAG.

> it's unclear to me how to make this work given that we cannot extend `TypeError`

That's an interop risk I didn't consider. I think it's somewhat unlikely that there are libraries out there that depend on `TypeError`. Skimming the spec, it looks like libraries that hard-code that assumption would already be incorrect, since we can throw an "AbortError" `DOMException`. Adding another possible `DOMException` doesn't seem unthinkable.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/517#issuecomment-436898694