Re: [whatwg/fetch] Change default of request's credentials mode (#1153)

Many parts of HTML fail to set credentials mode, I think? E.g. a bunch of navigation ones:

> Let resource be a new request whose url is url and whose referrer policy is the current state of element's referrerpolicy content attribute.

> If destination is not a request, then set destination to a new request whose URL is destination.

> Plan to navigate to a new request whose url is parsed action, method is method, header list consists of `Content-Type`/MIME type, and body is body.

> Let request be a new request whose URL is urlRecord.

(and more I skipped over)

importScripts():

> Let request be a new request whose url is url, client is settings object, destination is "script", parser metadata is "not parser-inserted", synchronous flag is set, and whose use-URL-credentials flag is set.

Downloads:

> Let request be a new request whose url is URL, client is entry settings object, initiator is "download", destination is the empty string, and whose synchronous flag and use-URL-credentials flag are set.

I also found service worker script imports:

> Let importRequest be a new request whose url is importUrl, client is job’s client, destination is "script", parser metadata is "not parser-inserted", synchronous flag is set, and whose use-URL-credentials flag is set.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/1153#issuecomment-771002699