- From: npm1 <notifications@github.com>
- Date: Tue, 13 Apr 2021 14:16:43 -0700
- To: whatwg/fetch <fetch@noreply.github.com>
- Cc: Subscribed <subscribed@noreply.github.com>
Received on Tuesday, 13 April 2021 21:16:56 UTC
> I think this is problematic as this would distinguish a CORS network error from other network errors. That they are indistinguishable is a desirable security property. We expose errors in RT to prevent an attacker from distinguishing HTTP status codes (success vs errors). Would something similar apply here for CORS or not really (distinguishing success vs failed)? -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/whatwg/fetch/pull/1202#issuecomment-819060502
Received on Tuesday, 13 April 2021 21:16:56 UTC