Re: [whatwg/fetch] Define opaque-response blocking (updated) (PR #1755)

zcorpan left a comment (whatwg/fetch#1755)

FedCM's no-cors requests get opaque responses as specified, so FedCM can't read them, and ORB and CORP apply. Gecko and Chromium both fetch these in the privileged process and only pass derived values (e.g. the token) to the page. Gecko skips ORB and CORP (`neverTaint`, [bug 1945565](https://bugzilla.mozilla.org/show_bug.cgi?id=1945565)). Chromium applies CORP, so e.g. `CORP: same-origin` on the config blocks FedCM.

#1966 and w3c-fedid/FedCM#852 make these responses non-opaque, matching Gecko. Then I'll drop the "webidentity" exemption here. The test is in web-platform-tests/wpt#64714.

Would Chromium be OK with not applying CORP to FedCM requests? cc @cbiesinger @npm1 @anforowicz

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/1755#issuecomment-6630450145
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/fetch/pull/1755/c6630450145@github.com>