[whatwg/fetch] Referrer policy of "no-referrer" sets Origin to null on same-origin "cors" requests (#1022)

In particular, for requests whose method is neither GET nor HEAD due to step 3 of https://fetch.spec.whatwg.org/#append-a-request-origin-header. This is not web-compatible as per https://bugzilla.mozilla.org/show_bug.cgi?id=1632204.

This means we need to revisit https://github.com/web-platform-tests/wpt/pull/22567 and this algorithm yet again.

Given that we have to reveal the origin, the simplest would be to always include it for "cors" requests, including when they are same-origin. I.e., change the check for response tainting is "cors" to mode is "cors". (This might well be how things behaved in the past.)

cc @rwlbuis @yutakahirano @JuniorHsu 

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/1022