Re: [whatwg/fetch] Doc: failed CORS fetch with credentials should ignore Set-Cookie response header (#855)

> Allowing them gives out similar functionality as on the other two browsers.

Thanks for checking, @Osintopsec!

> Yeah, I was afraid of that, but it's still rather unclean to throw after side effects for the caller have happened, if you allow me to compare a fetch with a function call.

I agree that it would be good in the abstract to change browsers to reject the cookie if the request is rejected. To do so in Chrome, we'd need to do a good deal of refactoring in our network stack, and do whatever measurement work was necessary to convince ourselves that we could make this change without breaking too much.

Is there a risk here beyond the uncleanliness of the result? If not, I can think of more than a few places I'd like to clean up before coming to this issue.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/855#issuecomment-451464605