Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Editorial: Add guidelines for external specs about CORS, cross-origin isolation and TAO #1806

Open
wants to merge 8 commits into
base: main
Choose a base branch
from
Open

Editorial: Add guidelines for external specs about CORS, cross-origin isolation and TAO #1806

Changes from 1 commit
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
987b95d
Add prose about CORS, cross-origin isolation and TAO
noamr Jan 28, 2025
ede95bc
Fix ref
noamr Jan 28, 2025
8f67c89
Fix ref
noamr Jan 28, 2025
6d70c4c
Update fetch.bs
noamr Jan 28, 2025
d38a228
Update fetch.bs
noamr Jan 28, 2025
5a0d77b
Update fetch.bs
noamr Jan 28, 2025
5062a48
Add more references for spec writers
noamr Jan 29, 2025
3ded9cd
Reword no-cors section a bit
noamr Jan 29, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Reword no-cors section a bit
  • Loading branch information
@noamr
noamr committed Jan 29, 2025
commit 3ded9cdb70129419a285d6ed9dcd179f1df3891b
6 changes: 3 additions & 3 deletions fetch.bs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9114,9 +9114,9 @@ restricting the network access, the embedder is restricted in what they are allo
to be done in a way that's opaque to the embedding origin. Only the user should have access to the
resource, not the embedder.
noamr marked this conversation as resolved.
Show resolved Hide resolved

<p>This mechanism of fetching should not be used in new specs. However, specs should be written with
the notion that no-CORS resources exists, and the new spec should not grant origins the ability to
read their contents.
<p>This mechanism of fetching should not be used in new specs. In addition, specs should be careful
not to accidentally expose data that was retrieved using "<code>no-cors</code>", e.g., by supplying
new mechanisms to read images without checking for this.

<p>Note that this is the default request mode, so new specs should be deliberate about setting the
request's <a for=request>mode</a> to "<code>cors</code>" or to "<code>same origin</code>", as
Expand Down