[whatwg/fetch] Let user agent features read responses to their no-cors requests (PR #1966)

FedCM makes no-cors requests on behalf of a web page and reads the responses itself. Without this, those responses are opaque filtered responses, so FedCM cannot read their status or headers, and its redirect mode of "error" results in a network error.

Add user-agent-no-cors to requests, which keeps the response tainting "basic" and allows any redirect mode. This matches Gecko.

Follows up on the discussion in #1533. Gecko implements this as a privileged `neverTaint` request option used by FedCM ([bug 1945565](https://bugzilla.mozilla.org/show_bug.cgi?id=1945565)). Chromium makes FedCM requests in the browser process and reads the responses. FedCM would set user-agent-no-cors to true on its config, well-known, accounts, and client metadata requests.

Since these responses are no longer opaque, ORB doesn't apply to them, so the "webidentity" exemption in #1755 becomes unnecessary once this lands.

- [ ] At least two implementers are interested (and none opposed):
   * Gecko
   * Chromium
- [x] [Tests](https://github.com/web-platform-tests/wpt) are written and can be reviewed and commented upon at:
   * Covered by existing FedCM tests, e.g. [fedcm-basic.https.html](https://github.com/web-platform-tests/wpt/blob/master/fedcm/fedcm-basic.https.html) (reads status and `Content-Type` of no-cors responses) and [fedcm-accounts-endpoint-rejects-redirects.https.html](https://github.com/web-platform-tests/wpt/blob/master/fedcm/fedcm-accounts-endpoint-rejects-redirects.https.html) (no-cors with redirect mode "error").
- [ ] [Implementation bugs](https://github.com/whatwg/meta/blob/main/MAINTAINERS.md#handling-pull-requests) are filed:
   * Chromium: …
   * Gecko: …
   * WebKit: …
   * Deno (not for CORS changes): …
- [ ] [MDN issue](https://github.com/whatwg/meta/blob/main/MAINTAINERS.md#handling-pull-requests) is filed: …
- [x] The top of this comment includes a [clear commit message](https://github.com/whatwg/meta/blob/main/COMMITTING.md) to use.

(See [WHATWG Working Mode: Changes](https://whatwg.org/working-mode#changes) for more details.)

You can view, comment on, or merge this pull request online at:

  https://github.com/whatwg/fetch/pull/1966

-- Commit Summary --

  * Let user agent features read responses to their no-cors requests

-- File Changes --

    M fetch.bs (22)

-- Patch Links --

https://github.com/whatwg/fetch/pull/1966.patch
https://github.com/whatwg/fetch/pull/1966.diff

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/1966
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/fetch/pull/1966@github.com>