Re: CfC: Republish MIX as CR; deadline July 29th.

On Thu, Jul 30, 2015 at 12:01 PM, Mike West <mkwst@google.com> wrote:
> That said, it doesn't seem to me that the property we're looking for
> actually conflicts with "destination context". Aren't they the same thing?
> That is, they both seem to say "Go execute Fetch. Oh, and by the way, we
> intend to use the response in this particular way."

Well, except the idea with "destination context" was that we'd only
use it for prioritization and `Accept` header initialization. Not
security checks. Since otherwise I could fetch something in a document
and bypass connect-src by saying it's for an "image" and then feed the
response to a <script>. Or some such.


-- 
https://annevankesteren.nl/

Received on Thursday, 30 July 2015 10:12:05 UTC