Re: [whatwg/fetch] COEP:credentialless and the HTTP cache. (#1253) from Anne van Kesteren on 2021-08-05 (public-webapps-github@w3.org from August 2021)

From: Anne van Kesteren <notifications@github.com>
Date: Thu, 05 Aug 2021 02:31:37 -0700
To: whatwg/fetch <fetch@noreply.github.com>
Cc: Subscribed <subscribed@noreply.github.com>
Message-ID: <whatwg/fetch/issues/1253/893311169@github.com>

I don't agree that the NPK is purely for privacy. It mitigates a number of XS-Leaks attacks. I suppose you are saying those are not mitigated (as much) if the user has a local caching proxy, which seems believable. It would be great to see more research in that area.

If anything this reads more like an argument to me that NPK should be exposed (somehow) for users with local caching proxies. (And NPK should be extended to cater for this use case.)

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/1253#issuecomment-893311169

Received on Thursday, 5 August 2021 09:31:49 UTC