Re: [whatwg/fetch] Define opaque-response blocking (updated) (PR #1755)

zcorpan left a comment (whatwg/fetch#1755)

Status update (@farre and I are working on this to align with Gecko or Chromium or both):

- 958e7eb: a blocked `fetch()` response gets a null body. Allowed ones keep theirs, so a service worker can pass them on.
- aba078b: sniffed audio, video, and images are allowed regardless of the media request state.
- 578e394: FedCM is exempt for now (see my previous comment).
- 173b75d: restores #1442's nosniff + blocklisted check.
- Tests: web-platform-tests/wpt#64714.

To do:

- @annevk, thanks for the AI review. 173b75d covers the nosniff blocker and [wpt#64714](https://github.com/web-platform-tests/wpt/pull/64714) updates `expected_block`. Still need to go through the rest.
- Remaining differences with Gecko/Chromium: the DASH/HLS/VTT and `audio/mpeg`-style allowances, the JSON check on decoded text, the fallback encoding, and tying "subsequent" to a URL that sniffed as media.
- Gecko still blocks beacon responses instead of filtering them, so that needs a bug.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/1755#issuecomment-6632909944
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/fetch/pull/1755/c6632909944@github.com>