Re: [whatwg/fetch] CORS readability for no-cors requests (Issue #1839)

pmeenan left a comment (whatwg/fetch#1839)

Sorry, I was thinking more along the lines of "this response is always safe and readable from anywhere" like the issue started with (public, static resources).

If a response contains sensitive user data that the origin explicitly marks as `CORP: cross-origin` for a context where it thinks it is in a "safe" cross-origin then I can see why the context is needed across redirects. That feels like a generally risky thing to do for opaque no-cors requests but makes sense to protect against.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/1839#issuecomment-3548232850
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/fetch/issues/1839/3548232850@github.com>