Re: [whatwg/fetch] Add TAO check (#955)

annevk commented on this pull request.



> @@ -5075,6 +5083,34 @@ agent's <a>CORS-preflight cache</a> for which there is a <a>cache entry match</a
 </ol>
 
 
+<h3 id=tao-check>TAO check</h3>
+
+<p>To perform a <dfn id=concept-tao-check>TAO check</dfn> for a <var>request</var> and
+<var>response</var>, run these steps:
+
+<ol>
+ <li><p>If <var>response</var>'s <a for=request>timing allow failed flag</a> is set, then return
+ failure.
+
+ <li><p>If <var>request</var>'s <a for=request>tainted origin flag</a> is unset and
+ <var>response</var>'s <a for=response>location URL</a>'s <a for=url>origin</a> is
+ <a>same origin</a> with <var>request</var>'s <a for=request>origin</a>, then return success.

Well, you're checking location URL and that really only works if the response is a redirect, which isn't checked in this step and I also don't think matters. If from origin A you fetched a redirect from origin A it does not matter whether that redirect goes to A or B. You don't need a TAO check for it, right? Or are we requiring TAO for all redirect responses, even same-origin? (That might make some sense too, given how we don't normally expose redirects.)

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/955#discussion_r342501020