Re: [whatwg/fetch] Let Origin header honor referrer policy for non CORS request (#908)

annevk commented on this pull request.

Noticed a few issues unfortunately. I also added a note, please let me know if that looks good to you.

> +   <a for=request>header list</a>.
+
+   <li>
+    <p>Otherwise, if <var>httpRequest</var>'s <a for=request>method</a> is neither
+    `<code>GET</code>` nor `<code>HEAD</code>`, then switch on <var>httpRequest</var>'s
+    <a for=request>referrer policy</a>:
+
+    <dl class=switch>
+     <dt>"<code>no-referrer</code>"
+     <dd><p><a for="header list">Append</a> `<code>Origin</code>`/`<code>null</code>` to
+     <var>httpRequest</var>'s <a for=request>header list</a>.
+
+     <dt>"<code>no-referrer-when-downgrade</code>"
+     <dt>"<code>strict-origin</code>"
+     <dt>"<code>strict-origin-when-cross-origin</code>"
+     <dd><p>If <var>request</var>'s <a for=request>origin</a>'s <var>scheme</var> is

While reformatting I realized that this cannot work as there's no guarantee request's origin is an origin that has a scheme. So this also needs to account for the origin being an opaque origin.

Another problem here is that if this conditional isn't met, no header gets appended. That seems unlikely to be the intention?

One thing I was thinking that might make this easier if we split this out into its own algorithm, perhaps right below "Serializing a request origin". Something like "Appending a request Origin header".

As I know you're somewhat otherwise occupied let me know if I should help out here.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/908#pullrequestreview-251655269