Re: [whatwg/fetch] COEP:credentialless and the HTTP cache. (#1253)

@annevk Let me try framing it differently then:

- I understand you to be asking “Is this broken because NPK”, and I’m trying to explain, “No, because it’s already broken today for multiple users without NPK”.
- If you’re asking “Is this broken with NPK”, then the answer is “Yes, but it’s broken without NPK”.
- If you’re asking “Can we do something for NPK to fix this”, then I’m saying “Yes, we need the origin server to change, or we need to define new behavior for intermediaries.”
- If the question is “Is it better to change origin servers or intermediaries”, as a practical matter, I believe changing the origin server is more likely to succeed, because that’s something the origin server can control. Intermediary update rates are abysmal.


That’s not to say we can’t say “Why not both”, but to be clear, it seems the threat model you’re describing is an origin explicitly declaring its resources public and cacheable, and then being uncomfortable when they’re shared between different contexts (whether different meat people or different NPKs).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/1253#issuecomment-894196895