Re: [whatwg/fetch] Add TAO check (#955)

npm1 commented on this pull request.



> +<var>response</var>, run these steps:
+
+<ol>
+ <li><p>If <var>request</var>'s <a for=request>timing allow failed flag</a> is set, then return
+ failure.
+
+ <li><p>If <var>request</var>'s <a for=request>response tainting</a> is "<code>basic</code>", then return success.
+
+ <li><p>Let <var>values</var> be the result of
+ <a for="header list">getting, decoding, and splitting</a>
+ `<code>Timing-Allow-Origin</code></a>` from <var>response</var>'s <a for=response>header list</a>.
+
+ <li><p>If <var>values</var> contains `<code>*</code>`, then return success.
+
+ <li><p>Let <var>serializedOrigin</var> be the result of <a>serializing a request origin</a> with
+ <var>request</var>.

Also https://github.com/w3c/resource-timing/pull/218 (yes, still hand-wavy because what is a resource, but need to fix the use of 'resource' throughout in order to solve that problem).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/955#discussion_r348735897