Re: [whatwg/fetch] Proposal: Allow servers to take full responsibility for cross-origin access protection (#878)

From my perspective, this problem is best stated in terms of invariants: What does WHATWG guarantee will hold in all future versions of the fetch specification, and how can a server signal that they only rely on these guaranteed properties?

One candidate for an invariant is *No origin can access or tamper with the body of a request sent by a different origin without authorization by the sending origin or the user agent.*  If this invariant holds, then any server that ignores request headers will not be affected by future changes to the fetch specification.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/878#issuecomment-731406246