{"action":"created","issue":{"url":"https://api.github.com/repos/whatwg/fetch/issues/225","repository_url":"https://api.github.com/repos/whatwg/fetch","labels_url":"https://api.github.com/repos/whatwg/fetch/issues/225/labels{/name}","comments_url":"https://api.github.com/repos/whatwg/fetch/issues/225/comments","events_url":"https://api.github.com/repos/whatwg/fetch/issues/225/events","html_url":"https://github.com/whatwg/fetch/issues/225","id":136755767,"number":225,"title":"Should we send an Origin header for no-cors fetches?","user":{"login":"ehsan","id":168508,"avatar_url":"https://avatars.githubusercontent.com/u/168508?v=3","gravatar_id":"","url":"https://api.github.com/users/ehsan","html_url":"https://github.com/ehsan","followers_url":"https://api.github.com/users/ehsan/followers","following_url":"https://api.github.com/users/ehsan/following{/other_user}","gists_url":"https://api.github.com/users/ehsan/gists{/gist_id}","starred_url":"https://api.github.com/users/ehsan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ehsan/subscriptions","organizations_url":"https://api.github.com/users/ehsan/orgs","repos_url":"https://api.github.com/users/ehsan/repos","events_url":"https://api.github.com/users/ehsan/events{/privacy}","received_events_url":"https://api.github.com/users/ehsan/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"tyoshino","id":4511440,"avatar_url":"https://avatars.githubusercontent.com/u/4511440?v=3","gravatar_id":"","url":"https://api.github.com/users/tyoshino","html_url":"https://github.com/tyoshino","followers_url":"https://api.github.com/users/tyoshino/followers","following_url":"https://api.github.com/users/tyoshino/following{/other_user}","gists_url":"https://api.github.com/users/tyoshino/gists{/gist_id}","starred_url":"https://api.github.com/users/tyoshino/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tyoshino/subscriptions","organizations_url":"https://api.github.com/users/tyoshino/orgs","repos_url":"https://api.github.com/users/tyoshino/repos","events_url":"https://api.github.com/users/tyoshino/events{/privacy}","received_events_url":"https://api.github.com/users/tyoshino/received_events","type":"User","site_admin":false},"assignees":[{"login":"tyoshino","id":4511440,"avatar_url":"https://avatars.githubusercontent.com/u/4511440?v=3","gravatar_id":"","url":"https://api.github.com/users/tyoshino","html_url":"https://github.com/tyoshino","followers_url":"https://api.github.com/users/tyoshino/followers","following_url":"https://api.github.com/users/tyoshino/following{/other_user}","gists_url":"https://api.github.com/users/tyoshino/gists{/gist_id}","starred_url":"https://api.github.com/users/tyoshino/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tyoshino/subscriptions","organizations_url":"https://api.github.com/users/tyoshino/orgs","repos_url":"https://api.github.com/users/tyoshino/repos","events_url":"https://api.github.com/users/tyoshino/events{/privacy}","received_events_url":"https://api.github.com/users/tyoshino/received_events","type":"User","site_admin":false}],"milestone":null,"comments":3,"created_at":"2016-02-26T17:10:02Z","updated_at":"2016-08-10T13:57:33Z","closed_at":null,"body":"Currently there seems to be nothing that sets the `omit-Origin-header` flag for no-cors fetches, so per spec we should send the `Origin` header for such fetches which is very strange given that the `Origin` header is mostly used for CORS."},"comment":{"url":"https://api.github.com/repos/whatwg/fetch/issues/comments/238874536","html_url":"https://github.com/whatwg/fetch/issues/225#issuecomment-238874536","issue_url":"https://api.github.com/repos/whatwg/fetch/issues/225","id":238874536,"user":{"login":"annevk","id":1544111,"avatar_url":"https://avatars.githubusercontent.com/u/1544111?v=3","gravatar_id":"","url":"https://api.github.com/users/annevk","html_url":"https://github.com/annevk","followers_url":"https://api.github.com/users/annevk/followers","following_url":"https://api.github.com/users/annevk/following{/other_user}","gists_url":"https://api.github.com/users/annevk/gists{/gist_id}","starred_url":"https://api.github.com/users/annevk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/annevk/subscriptions","organizations_url":"https://api.github.com/users/annevk/orgs","repos_url":"https://api.github.com/users/annevk/repos","events_url":"https://api.github.com/users/annevk/events{/privacy}","received_events_url":"https://api.github.com/users/annevk/received_events","type":"User","site_admin":false},"created_at":"2016-08-10T13:57:33Z","updated_at":"2016-08-10T13:57:33Z","body":"@tyoshino in https://github.com/whatwg/xhr/issues/31 you said @hiroshige-g would check this out but it never happened. I'd love for you to check my proposal.\r\n\r\nPer https://bugzilla.mozilla.org/show_bug.cgi?id=1272302 it does seem that Chrome includes `Origin` for \"no-cors\" (and probably other cases) when method is POST.\r\n\r\nI'm inclined to make these changes:\r\n\r\n* Remove \"omit-Origin-header flag\"\r\n* Change HTTP-network-or-cache fetch to include the `Origin` header when either _CORS flag_ is set or request's method is neither HEAD nor GET. (I could be convinced to only include it for POST, but it seems more reasonable to protect the other unsafe methods too.)"}}
{"actor":{"display_login":"annevk"}}