Re: [whatwg/fetch] Handle request's window when from browser UI (PR #1821) from Emma Zühlcke on 2025-05-02 (public-webapps-github@w3.org from May 2025)

From: Emma Zühlcke <notifications@github.com>
Date: Fri, 02 May 2025 04:22:10 -0700
To: whatwg/fetch <fetch@noreply.github.com>
Cc: Subscribed <subscribed@noreply.github.com>
Message-ID: <whatwg/fetch/pull/1821/c2846981103@github.com>

Trikolon left a comment (whatwg/fetch#1821)

For Firefox we only changed the behavior (blank page, url bar updated) for cross origin sites to avoid spoofing. Demo: https://eviltrap.site/trap/http-auth-prompt-spoof/. For same-origin that's not really a concern.

I'm in favor of aligning with Chrome and inserting a blank interstitial for both cross and same origin cases to make the behavior more consistent.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/1821#issuecomment-2846981103
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/fetch/pull/1821/c2846981103@github.com>

Received on Friday, 2 May 2025 11:22:14 UTC