This is an archived snapshot of W3C's public bugzilla bug tracker, decommissioned in April 2019. Please see the home page for more details.

Bug 18215 - No CORS and not-same-origin should not fetch the URL
Summary: No CORS and not-same-origin should not fetch the URL
Status: RESOLVED FIXED
Alias: None
Product: HTML WG
Classification: Unclassified
Component: HTML5 spec (show other bugs)
Version: unspecified
Hardware: Other other
: P3 normal
Target Milestone: ---
Assignee: Silvia Pfeiffer
QA Contact: HTML WG Bugzilla archive list
URL: http://www.whatwg.org/specs/web-apps/...
Whiteboard:
Keywords: CR
Depends on:
Blocks:
 
Reported: 2012-07-18 17:42 UTC by contributor
Modified: 2013-09-16 22:43 UTC (History)
6 users (show)

See Also:


Attachments

Description contributor 2012-07-18 17:42:38 UTC
This was was cloned from bug 17305 as part of operation convergence.
Originally filed: 2012-06-04 13:28:00 +0000

================================================================================
 #0   contributor@whatwg.org                          2012-06-04 13:28:28 +0000 
--------------------------------------------------------------------------------
Specification: http://www.whatwg.org/specs/web-apps/current-work/multipage/fetching-resources.html
Multipage: http://www.whatwg.org/C#potentially-cors-enabled-fetch
Complete: http://www.whatwg.org/c#potentially-cors-enabled-fetch

Comment:
No CORS and not-same-origin should not fetch the URL

Posted from: 85.227.152.202 by simonp@opera.com
User agent: Opera/9.80 (Macintosh; Intel Mac OS X 10.7.3; U; en) Presto/2.10.229 Version/11.64
================================================================================
 #1   Simon Pieters                                   2012-06-04 13:37:25 +0000 
--------------------------------------------------------------------------------
When failure mode is "fail" and mode is "No CORS", we shouldn't fetch anything at all but just fail directly.
================================================================================
 #2   Simon Pieters                                   2012-06-05 07:31:57 +0000 
--------------------------------------------------------------------------------
Similarly, if /default/ is "fail", and /mode/ is "No CORS", and /URL/ is a same-origin URL that redirects to a different-origin URL, the redirect shouldn't be followed but should fail at that point.
================================================================================
Comment 1 Travis Leithead [MSFT] 2013-09-16 22:43:38 UTC
Was resolved fixed (a year ago) by Ian. The relevant checkin was:

https://github.com/w3c/html/commit/ebcd9542f528d983ebe9bbcaa3823001b6448f4f

which has subsequently been integrated over in Robin's mega-merge early this year.