[whatwg/fetch] Editorial: using serialized origin in TAO check and "null" (Issue #1421)

In https://fetch.spec.whatwg.org/#tao-check, the TAO header is checked to see if it includes request's serialized origin.
However, for redirect-tainted requests, https://fetch.spec.whatwg.org/#serializing-a-request-origin will return the string `"null"`.
This would imply that `Timing-Allow-Origin: origin-a.com, null` would succeed for redirect-tainted requests.

Suggesting not to use `serializing-a-request-origin` here.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/1421
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/fetch/issues/1421@github.com>