Re: [whatwg/fetch] Add TAO check (#955)

> CORS doesn't have anything to do with same-origin redirects. The reason we don't expose them is because they can contain secrets: https://fetch.spec.whatwg.org/#atomic-http-redirect-handling.

The nature of the attack is not 100% clear to me in a same-origin context without any cross-origin redirects. Is the concern that it'd enable an origin to guess its own http-only cookies?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/955#issuecomment-550582198