{"action":"created","issue":{"url":"https://api.github.com/repos/w3c/webappsec-suborigins/issues/52","repository_url":"https://api.github.com/repos/w3c/webappsec-suborigins","labels_url":"https://api.github.com/repos/w3c/webappsec-suborigins/issues/52/labels{/name}","comments_url":"https://api.github.com/repos/w3c/webappsec-suborigins/issues/52/comments","events_url":"https://api.github.com/repos/w3c/webappsec-suborigins/issues/52/events","html_url":"https://github.com/w3c/webappsec-suborigins/pull/52","id":183164230,"number":52,"title":"Force with credentials","user":{"login":"metromoxie","id":401207,"avatar_url":"https://avatars.githubusercontent.com/u/401207?v=3","gravatar_id":"","url":"https://api.github.com/users/metromoxie","html_url":"https://github.com/metromoxie","followers_url":"https://api.github.com/users/metromoxie/followers","following_url":"https://api.github.com/users/metromoxie/following{/other_user}","gists_url":"https://api.github.com/users/metromoxie/gists{/gist_id}","starred_url":"https://api.github.com/users/metromoxie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/metromoxie/subscriptions","organizations_url":"https://api.github.com/users/metromoxie/orgs","repos_url":"https://api.github.com/users/metromoxie/repos","events_url":"https://api.github.com/users/metromoxie/events{/privacy}","received_events_url":"https://api.github.com/users/metromoxie/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2016-10-14T22:31:15Z","updated_at":"2016-10-15T05:28:51Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/w3c/webappsec-suborigins/pulls/52","html_url":"https://github.com/w3c/webappsec-suborigins/pull/52","diff_url":"https://github.com/w3c/webappsec-suborigins/pull/52.diff","patch_url":"https://github.com/w3c/webappsec-suborigins/pull/52.patch"},"body":"@devd can you look at this one? In short, I think I understand the credential issue a lot better now, so hopefully this fixes the actual issue without introducing any others. I've also been more explicit in how it integrates with XHR."},"comment":{"url":"https://api.github.com/repos/w3c/webappsec-suborigins/issues/comments/253964199","html_url":"https://github.com/w3c/webappsec-suborigins/pull/52#issuecomment-253964199","issue_url":"https://api.github.com/repos/w3c/webappsec-suborigins/issues/52","id":253964199,"user":{"login":"metromoxie","id":401207,"avatar_url":"https://avatars.githubusercontent.com/u/401207?v=3","gravatar_id":"","url":"https://api.github.com/users/metromoxie","html_url":"https://github.com/metromoxie","followers_url":"https://api.github.com/users/metromoxie/followers","following_url":"https://api.github.com/users/metromoxie/following{/other_user}","gists_url":"https://api.github.com/users/metromoxie/gists{/gist_id}","starred_url":"https://api.github.com/users/metromoxie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/metromoxie/subscriptions","organizations_url":"https://api.github.com/users/metromoxie/orgs","repos_url":"https://api.github.com/users/metromoxie/repos","events_url":"https://api.github.com/users/metromoxie/events{/privacy}","received_events_url":"https://api.github.com/users/metromoxie/received_events","type":"User","site_admin":false},"created_at":"2016-10-15T05:28:51Z","updated_at":"2016-10-15T05:28:51Z","body":"What I meant by \"excludes regular resource requests and fetch\" is that the flag does nothing to regular resource requests and fetch. Indeed, the reason we don't need to do anything special for regular requests is that we are not modifying RFC 6266, so cookies are still sent on regular resource requests essentially based on the *physical origin* and not the suborigin (hence why we need the document to be cookie-averse). So regular resource requests have cookies attached across the physical origin, and there's nothing special with suborigins essentially."}}
{"actor":{"display_login":"metromoxie"}}