Re: [whatwg/fetch] fetch() "no-cors": cross-origin to same-origin redirect taints response (#737)

Uploaded a test in https://github.com/web-platform-tests/wpt/pull/14112
According that test, Firefox and Chrome do treat A->B->A image as same origin while Safari does not. Not sure about Edge.
It might be worth authoring a similar test for scripts and stylesheets.

> That sounds exciting, though for `<img>` a workaround would likely be to use `<iframe>` which I'm 99% sure on only considers the final response for origin comparisons.

You are probably right, we probably only consider final URLs for iframes origin checks.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/737#issuecomment-439592046