Re: [whatwg/fetch] Allow redirects on cross-origin credentialed requests (#1235)

The SSO provider has no reason to allow cross-origin requests to access the data it returns. And I'm not even asking for that data. The rule on credentialed redirects doesn't actually make any sense to me -- if the redirect chain ends in a CORS-eligible response, why does it matter that it went through a redirect to get there?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/1235#issuecomment-842719862