[whatwg/fetch] Request constructor should propagate origin internal field (#1321)

Currently, the Request constructor always resets the request `origin` internal field to "client".  See step 12 in:

https://fetch.spec.whatwg.org/#dom-request

This is problematic because a pass-through FetchEvent SW handler will end up using the service worker's origin for things like:

* Origin header
* Sec-Fetch-Site header
* SameSite cookies

It would be safer for sites if we propagated the internal `origin` field from the original request.  We also need to propagate the `tainted origin flag` as well in order to properly handle redirects.

This was discussed at the virtual F2F (w3c/ServiceWorker#1604).  [Notes](https://docs.google.com/document/d/1q74ATke1oG2jEval1yBTVIrXZGItFi6DR5l8n_8ybgs/edit#bookmark=id.bg7ds8878foi) are available.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/1321