Re: [whatwg/fetch] Let Origin header honor referrer policy for non CORS request (#908)

JuniorHsu commented on this pull request.



> +   <a for=request>header list</a>.
+
+   <li>
+    <p>Otherwise, if <var>httpRequest</var>'s <a for=request>method</a> is neither
+    `<code>GET</code>` nor `<code>HEAD</code>`, then switch on <var>httpRequest</var>'s
+    <a for=request>referrer policy</a>:
+
+    <dl class=switch>
+     <dt>"<code>no-referrer</code>"
+     <dd><p><a for="header list">Append</a> `<code>Origin</code>`/`<code>null</code>` to
+     <var>httpRequest</var>'s <a for=request>header list</a>.
+
+     <dt>"<code>no-referrer-when-downgrade</code>"
+     <dt>"<code>strict-origin</code>"
+     <dt>"<code>strict-origin-when-cross-origin</code>"
+     <dd><p>If <var>request</var>'s <a for=request>origin</a>'s <var>scheme</var> is

> While reformatting I realized that this cannot work as there's no guarantee request's origin is an origin that has a scheme. So this also needs to account for the origin being an opaque origin.

Done. Not sure if the fetch spec provide short-circuit behavior for (and/or)
> 
> Another problem here is that if this conditional isn't met, no header gets appended. That seems unlikely to be the intention?

It's horrible. Thanks for picking this.
> 
> One thing I was thinking that might make this easier if we split this out into its own algorithm, perhaps right below "Serializing a request origin". Something like "Appending a request Origin header".
> 

It's a bit complicated now, so IMO it's a good idea to isolate it.

@annevk Please take a look for the new patch. Thanks!


-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/908#discussion_r295695917