27909 2015-01-27 15:50:17 +0000 "If request's url contains a Known HSTS Host, mo..." 2015-01-27 17:34:46 +0000 1 1 1 Unclassified WHATWG Fetch unspecified PC All RESOLVED FIXED P2 normal Unsorted 1 mkwst annevk mike sideshowbarker+fetchspec oldest_to_newest 117513 0 mkwst 2015-01-27 15:50:17 +0000 https://fetch.spec.whatwg.org/#fetching [[ If request's url contains a Known HSTS Host, modify it per the requirements of the "URI [sic] Loading and Port Mapping" chapter of HTTP Strict Transport Security. [HSTS] ]] HSTS happens after mixed content (and CSP) checks in WebKit, Blink, and Gecko. Fetch should de jureize this de facto standard. 117520 1 annevk 2015-01-27 17:34:46 +0000 Thanks! Per IM discussion I placed HSTS after Referrer. https://github.com/whatwg/fetch/commit/b8c2c4964c233cd3616042c04e2c14e0ff25485d