Re: [whatwg/fetch] Specify the behavior of `COEP: credentialless`, (#1229)

> > However the second origin should continue to be the client's origin. For instance, in the base case of a cross-origin no-cors request with no redirects, credentials must not be included. So the comparison is in between the client's origin and the request's current URL.
> 
> Sorry, can you give me an example? request's origin and request's client's origin are usually the same, but other checks such as [CORS](https://fetch.spec.whatwg.org/#cors-check) use request's origin, so I want to understand why in this case we need to use the client's origin.

In the example above, a.com requests b.com in no-cors mode, with COEP:credentialless.
This gives:
- request’s mode == "no-cors"
- request's client is not null.
- request's client's embedderPolicy is "credentialless".
- request's client's origin is "a.com"
- request's currentURL's origin is b.com   (a.com != b.com)

That's the 4 condition in the "COEP allow credentials" algorithm and it return false.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/1229#issuecomment-858639943