[whatwg/fetch] COEP credentials/taint (Issue #1958)

koal44 created an issue (whatwg/fetch#1958)

#1229 introduced `COEP: credentialless`. The later cookie integration in #1807 appears to have inverted the original intent:

```diff
To check if Cross-Origin-Embedder-Policy allows credentials...

-4. If request's origin is same origin with request's current URL's origin and request's tainted origin flag is not set, then return true.
+5. If request's origin is same origin with request's current URL's origin and request's redirect-taint is not "same-origin", then return true.
```

I think "not" should be removed.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/1958
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/fetch/issues/1958@github.com>