Re: [whatwg/fetch] Sketch out a CORP-only mode. (#893)

annevk commented on this pull request.



>  
-  <p class="note no-backref">While redirects that carry  a
-  `<a http-header><code>Cross-Origin-Resource-Policy</code></a>` header are checked, redirects
-  without such a header resulting in <var>response</var> do not contribute to this algorithm. I.e.,
-  <var>request</var>'s <a for=request>tainted origin flag</a> is not checked.
+   <li><p><var>request</var> is a <a>navigation request</a> whose <a for=request>reserved client</a>
+   is an <a for=/>environment</a> whose <a for=environment>target browsing context</a> is neither a
+   <a>nested browsing context</a> nor an <a>auxiliary browsing context</a>.

Without process isolation on the agent cluster level, right.

I think the navigation checks only make sense when the flag is set on a document. And that flag only makes sense if COOP is also set. (COOP guaranteeing process isolation on the browsing context group level.)

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/893#discussion_r274901456