{"action":"created","issue":{"url":"https://api.github.com/repos/whatwg/fetch/issues/402","repository_url":"https://api.github.com/repos/whatwg/fetch","labels_url":"https://api.github.com/repos/whatwg/fetch/issues/402/labels{/name}","comments_url":"https://api.github.com/repos/whatwg/fetch/issues/402/comments","events_url":"https://api.github.com/repos/whatwg/fetch/issues/402/events","html_url":"https://github.com/whatwg/fetch/issues/402","id":185090255,"number":402,"title":"CORS protocol and HTTP caches","user":{"login":"yutakahirano","id":5187874,"avatar_url":"https://avatars.githubusercontent.com/u/5187874?v=3","gravatar_id":"","url":"https://api.github.com/users/yutakahirano","html_url":"https://github.com/yutakahirano","followers_url":"https://api.github.com/users/yutakahirano/followers","following_url":"https://api.github.com/users/yutakahirano/following{/other_user}","gists_url":"https://api.github.com/users/yutakahirano/gists{/gist_id}","starred_url":"https://api.github.com/users/yutakahirano/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yutakahirano/subscriptions","organizations_url":"https://api.github.com/users/yutakahirano/orgs","repos_url":"https://api.github.com/users/yutakahirano/repos","events_url":"https://api.github.com/users/yutakahirano/events{/privacy}","received_events_url":"https://api.github.com/users/yutakahirano/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2016-10-25T11:31:21Z","updated_at":"2016-10-31T15:21:40Z","closed_at":null,"body":"The section says\n\n> If CORS protocol requirements are more complicated than setting `Access-Control-Allow-Origin` to \\* or a static origin, `Vary` is to be used.\n\nIs it saying that we need a `Vary` header if we want to add \"Access-Control-Allow-Origin: *\" to a response only when an `Origin` header is present on the request?\n"},"comment":{"url":"https://api.github.com/repos/whatwg/fetch/issues/comments/257323396","html_url":"https://github.com/whatwg/fetch/issues/402#issuecomment-257323396","issue_url":"https://api.github.com/repos/whatwg/fetch/issues/402","id":257323396,"user":{"login":"mayhemer","id":2439817,"avatar_url":"https://avatars.githubusercontent.com/u/2439817?v=3","gravatar_id":"","url":"https://api.github.com/users/mayhemer","html_url":"https://github.com/mayhemer","followers_url":"https://api.github.com/users/mayhemer/followers","following_url":"https://api.github.com/users/mayhemer/following{/other_user}","gists_url":"https://api.github.com/users/mayhemer/gists{/gist_id}","starred_url":"https://api.github.com/users/mayhemer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mayhemer/subscriptions","organizations_url":"https://api.github.com/users/mayhemer/orgs","repos_url":"https://api.github.com/users/mayhemer/repos","events_url":"https://api.github.com/users/mayhemer/events{/privacy}","received_events_url":"https://api.github.com/users/mayhemer/received_events","type":"User","site_admin":false},"created_at":"2016-10-31T15:21:40Z","updated_at":"2016-10-31T15:21:40Z","body":"I will ask for some clarifications too:\r\n- what is \"the credentials mode\"?  does it mean to allow sending credentials and cookies with the request?\r\n\r\nIf so, then it's what we call \"anonymous\" mode (or flag) on a request.\r\n\r\nTo clarify \"load context info\": it's a set of flags and values that separate (identifies) the context where from the request is being made and separates cache entries in the http cache this way.\r\n\r\nLoad context info is carrying the following information:\r\n- origin attributes, which is a structure holding:\r\n  - user context id (personal/work/backing/shopping...)\r\n  - private browsing mode (aka incognito)\r\n  - few others, not related to this bug\r\n- anonymous load (aka 'no credentials')\r\n\r\nAn entry in the http cache is identified by: [load context info][URL w/o hash] tuple.\r\n\r\nRe https://github.com/whatwg/fetch/issues/402#issuecomment-256020019:\r\n> If (req1, res1) is cached, is the HTTP cache allowed to serve res1 for req2?\r\n\r\nYes, if there is nothing more said about the cachability of the response.  Only solution is the server side as mentioned in https://bugs.chromium.org/p/chromium/issues/detail?id=658575#c5.  \r\n\r\nWhat you suggest sounds like we may want to isolate the cache by a CORS flag (add it to the load context info).  \r\n\r\nThe result would be: let's have pages: foo.com/, bar.com/, baz.com/, all referring a resources at  foo.com/script.js.  In the http cache there would then be exactly two entries:\r\n- foo.com/script.js as referenced from foo.com/\r\n- foo.com/script.js as referenced from bar.com/ and baz.com/ (and whatever origin not being foo.com)\r\n\r\nTho, I believe this could well break the web.  Hence there is the requirement (suggestion?) to use the 'Vary: origin' response header which can be managed by the web admins.  OTOH, this puts the CORS protection on their shoulders.  Maybe the browser should help here somehow?\r\n"}}
{"actor":{"display_login":"mayhemer"}}