Re: [whatwg/fetch] Hide range values from no-cors cross-origin range requests (Issue #1936)

jakearchibald left a comment (whatwg/fetch#1936)

In WHATNOT:

@annevk had a light preference towards "option 1", as in you need the `crossorigin` attribute, and therefore a CORS request, for media requests to go through a service worker, even for same origin. He accepted that both options seem ok, but every time we do no-cors stuff it often ends up in a security issues (this whole issue is evidence of that).

No one else had views either way.

@noamr said he'd raise it with Chrome folks.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/1936#issuecomment-6064562676
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/fetch/issues/1936/6064562676@github.com>