Re: [whatwg/fetch] Add `cross-site` to allowed CORP header values. (#1016) from Mike West on 2020-04-01 (public-webapps-github@w3.org from April 2020)

From: Mike West <notifications@github.com>
Date: Wed, 01 Apr 2020 14:15:43 +0000 (UTC)
To: whatwg/fetch <fetch@noreply.github.com>
Cc: Subscribed <subscribed@noreply.github.com>
Message-ID: <whatwg/fetch/pull/1016/c607275529@github.com>

Hrm. I see `same-origin`, `same-site`, and `cross-site` as an expanding set of buckets, each encompassing the previous. In that version of the tale, `cross-site` means `cross-site-and-also-same-site-because-if-you-can-load-me-i-can-obviously-load-me`. I recognize the ambiguity, but `cross-origin` doesn't seem significantly better (given that some cross-origin resources are, in fact, same-site.

Meh. Given that we have implementations with this wording in both Chromium and Firefox, I guess I can live with `cross-origin`, and I'll update this patch accordingly. Spelling is hard.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/1016#issuecomment-607275529

Received on Wednesday, 1 April 2020 14:15:58 UTC