Re: [whatwg/fetch] Send "null" Origin headers on cross-origin requests from an RFC7686 address (Issue #1350)

If I understand the proposal correctly, this would have the effect of disabling meaningful access controls for resources that `.onion` pages wish to access (since any cross-origin response to a CORS-mode request would have to send headers that allowed any opaque origin to access the resource). That seems like a somewhat counterproductive restriction.

A weaker version of this proposal would apply the restriction to no-cors requests, but not to CORS requests (similar conceptually to the [`credentialless`](https://html.spec.whatwg.org/#coep-credentialless) COEP mode). Is that direction worth exploring?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/1350#issuecomment-964887038