- From: npm1 <notifications@github.com>
- Date: Wed, 30 Oct 2019 08:01:55 -0700
- To: whatwg/fetch <fetch@noreply.github.com>
- Cc: Subscribed <subscribed@noreply.github.com>
Received on Wednesday, 30 October 2019 15:02:01 UTC
npm1 commented on this pull request. > @@ -5075,6 +5083,34 @@ agent's <a>CORS-preflight cache</a> for which there is a <a>cache entry match</a </ol> +<h3 id=tao-check>TAO check</h3> + +<p>To perform a <dfn id=concept-tao-check>TAO check</dfn> for a <var>request</var> and +<var>response</var>, run these steps: + +<ol> + <li><p>If <var>response</var>'s <a for=request>timing allow failed flag</a> is set, then return + failure. + + <li><p>If <var>request</var>'s <a for=request>tainted origin flag</a> is unset and + <var>response</var>'s <a for=response>location URL</a>'s <a for=url>origin</a> is + <a>same origin</a> with <var>request</var>'s <a for=request>origin</a>, then return success. Yea that makes sense. Should we still use 'serializing a request origin' then, or perhaps avoid effects from the 'tainted origin flag' altogether here? In our current behavior, that's what we do. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/whatwg/fetch/pull/955#discussion_r340669865
Received on Wednesday, 30 October 2019 15:02:01 UTC