Re: [whatwg/fetch] Referrer policy of "no-referrer" sets Origin to null on same-origin "cors" requests (#1022)

The current implementation in Gecko could be specified by roughly like this:

> 2. If request’s response tainting is "cors" or request’s mode is "websocket", then append (`Origin`, serializedOrigin) to request’s header list. (unchanged)
> 3. Otherwise, if request’s method is neither `GET` nor `HEAD`, then: 
>  3.1 If request’s mode is "cors", then append (`Origin`, serializedOrigin) to request’s header list. 
>  3.2 Otherwise, Switch on request’s referrer policy: [....]
>  3.3 Append (`Origin`, serializedOrigin) to request’s header list.

So basically we always add the real Origin CORS requests that aren't  using the GET or HEAD request method.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/1022#issuecomment-1163283926

You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/fetch/issues/1022/1163283926@github.com>