Re: [whatwg/fetch] COEP:credentialless and the HTTP cache. (#1253)

Thanks! I understand now.
So the problem isn't proxy controlled by the website, but proxies controlled by the user (or their company). 

User's at risk would be the ones who have installed a local proxy and override Chrome to trust their certificates. There isn't much we can do against security vulnerabilities caused by local proxy, but the least we can do it to send them headers to do the separation correctly, even if we can't ensure they will.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/1253#issuecomment-892023087