Re: [CSP] Difference in browser behaviour for 304 responses from Anne van Kesteren on 2015-10-11 (public-webappsec@w3.org from October 2015)

From: Anne van Kesteren <annevk@annevk.nl>
Date: Sun, 11 Oct 2015 09:42:54 +0200
To: André N. Klingsheim <andre.klingsheim@owasp.org>
Cc: WebAppSec WG <public-webappsec@w3.org>
Message-ID: <CADnb78hQ7iLAfDjsj_j09UG_aUHmLeWhoRGCprKoHMFnAKArRw@mail.gmail.com>

On Sat, Oct 10, 2015 at 4:42 PM, André N. Klingsheim
<andre.klingsheim@owasp.org> wrote:
> This particular scenario is not mentioned in the spec, it would perhaps be
> worth specifying in the next version?

See https://github.com/whatwg/fetch/issues/97.

> Thoughts? Should I submit an issue and/or bug somewhere?

I would recommend filing a bug against Chromium. We want the
update-headers behavior for CORS too. Would make sense to keep that
consistent.

-- 
https://annevankesteren.nl/

Received on Sunday, 11 October 2015 07:43:19 UTC