Re: [whatwg/fetch] Let Origin header honor referrer policy for non CORS request (#908) from Anne van Kesteren on 2019-06-06 (public-webapps-github@w3.org from June 2019)

From: Anne van Kesteren <notifications@github.com>
Date: Thu, 06 Jun 2019 05:42:09 -0700
To: whatwg/fetch <fetch@noreply.github.com>
Cc: Subscribed <subscribed@noreply.github.com>
Message-ID: <whatwg/fetch/pull/908/c499477191@github.com>

CORS is something both sides opt into so it seems reasonable that in that case we leak the origin. We previously decided that the Referrer Policy would not influence CORS for that reason. However, Origin is also used outside of CORS and we have not effectively dealt with it there.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/908#issuecomment-499477191

Received on Thursday, 6 June 2019 12:42:31 UTC