- From: Boris Zbarsky <bzbarsky@MIT.EDU>
- Date: Tue, 28 Aug 2012 14:56:30 -0400
- To: whatwg <whatwg@whatwg.org>
On 8/28/12 2:04 PM, Boris Zbarsky wrote: > An open issue: what to do about @import? I haven't done anything magic > here yet. Inheriting the CORS mode from the importing sheet is a bit > weird Maybe I should explain "weird". If the CORS mode is inherited from the importing sheet, then I think the "origin" for the fetch should be the page, not the importing sheet, since the page is what would get access to the stylesheet data. Maybe this is OK, but it's non-obvious; usually for security purposes the importing sheet is what affects things like can-load checks, Referer headers, etc. -Boris
Received on Tuesday, 28 August 2012 18:57:02 UTC