Re: [whatwg/fetch] Cross-Origin-Resource-Policy shouldn't apply to browser-initiated requests (e.g. downloads) (#896) from Lukasz Anforowicz on 2019-04-17 (public-webapps-github@w3.org from April 2019)

From: Lukasz Anforowicz <notifications@github.com>
Date: Wed, 17 Apr 2019 15:41:51 -0700
To: whatwg/fetch <fetch@noreply.github.com>
Cc: Subscribed <subscribed@noreply.github.com>
Message-ID: <whatwg/fetch/issues/896/484288214@github.com>

FWIW, TIL that since Chrome 65 cross-origin <a download> are blocked (i.e. do not result in a download): https://bugs.chromium.org/p/chromium/issues/detail?id=714373

This means that (at least in Chrome?) there is no known scenario where a cross-origin download is triggered by a web initiator (other than a navigation to a `Content-Disposition: attachment` or non-renderable `Content-Type` and navigations are already exempt from CORP).  In other words, the problem indeed seems to be limited to browser-initiated downloads.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/896#issuecomment-484288214

Received on Wednesday, 17 April 2019 22:42:13 UTC