Re: [w3c/ServiceWorker] `CacheStorage` & `COEP:credentialless` (#1592)

Yes that true. I got confused with the Chrome implementation (where response_type is not computed yet for fetch) and my understanding of opaque response was a bit different than the reality (I didn't know about tainted_origin for cross-origin redirect).

Since the CORP check is not only run for CacheStorage, but also for normal fetch request, the current proposition would break normal fetch request. I should find a way to filter out:
- same-origin response,
- non-final response,
- non no-cors response.
Or alternatively not run this in the CORP check and make this specific to CacheStorage. I will have to rework this, find a solution and get back to you with something better.


-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/ServiceWorker/issues/1592#issuecomment-853343967