Re: [whatwg/fetch] Discuss: Removing `cache: reload` option from the API (#902)

Riffing on Yutaka's query parameters issue, if a response has a VARY header an attacker could request the url with a different set of matching request headers.  I believe most http caches only store one entry per URL, so this would evict the target url as well.  Kind of a corner case since it requires the response to use VARY, though.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/902#issuecomment-490507390