- From: Arthur Sonzogni <notifications@github.com>
- Date: Mon, 20 Sep 2021 08:12:52 -0700
- To: whatwg/fetch <fetch@noreply.github.com>
- Cc: Subscribed <subscribed@noreply.github.com>
Received on Monday, 20 September 2021 15:13:05 UTC
@ArthurSonzogni commented on this pull request. > @@ -1892,6 +1892,24 @@ source of security bugs. Please seek security review for features that deal with <a for="URL serializer"><i>exclude fragment</i></a> set to true. </ol> +<p>To check <dfn export>Cross-Origin-Embedder-Policy allows credentials</dfn>, given a +<a for=/>request</a> <var>request</var>, run theses steps: + +<ol> + <li><p>If <var>request</var>'s <a for=request>mode</a> is not <code>no-cors</code>", return + true.</p> + + <li><p>If <var>request</var>'s <a for=request>client</a> is null, return true.</p> + + <li><p>If <var>request</var>'s <a for=request>client</a>'s <a for="environment settings + object">embedder policy</a> is not + "<code><a for="embedder policy value">credentialless</a></code>", return true.</p> + + <li><p>If <var>request</var>'s <a for=request>origin</a> is <a>same origin</a> with + <var>request</var>'s <a for=request>current URL</a>'s <a for=url>origin</a>, return true.</p> (The corresponding WPT/chrome [change](https://github.com/web-platform-tests/wpt/pull/30871/files)) -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/whatwg/fetch/pull/1229#discussion_r712263286
Received on Monday, 20 September 2021 15:13:05 UTC