{"action":"created","issue":{"url":"https://api.github.com/repos/whatwg/fetch/issues/101","labels_url":"https://api.github.com/repos/whatwg/fetch/issues/101/labels{/name}","comments_url":"https://api.github.com/repos/whatwg/fetch/issues/101/comments","events_url":"https://api.github.com/repos/whatwg/fetch/issues/101/events","html_url":"https://github.com/whatwg/fetch/issues/101","id":99043394,"number":101,"title":"should navigation requests really be same-origin or no-cors?","user":{"login":"wanderview","id":1256526,"avatar_url":"https://avatars.githubusercontent.com/u/1256526?v=3","gravatar_id":"","url":"https://api.github.com/users/wanderview","html_url":"https://github.com/wanderview","followers_url":"https://api.github.com/users/wanderview/followers","following_url":"https://api.github.com/users/wanderview/following{/other_user}","gists_url":"https://api.github.com/users/wanderview/gists{/gist_id}","starred_url":"https://api.github.com/users/wanderview/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wanderview/subscriptions","organizations_url":"https://api.github.com/users/wanderview/orgs","repos_url":"https://api.github.com/users/wanderview/repos","events_url":"https://api.github.com/users/wanderview/events{/privacy}","received_events_url":"https://api.github.com/users/wanderview/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-08-04T19:28:01Z","updated_at":"2015-08-06T06:37:49Z","closed_at":null,"body":"Step 2.2 of [HTTP Fetch][] currently has the following note:\r\n\r\n> The underlying assumption here is that all client requests use mode \"same-origin\", which is currently not explicitly stated for navigation requests. \r\n\r\nThis is necessary for the step 2.2 checks to properly block opaque responses from being used to intercept a navigation.\r\n\r\nIt seems, however, forcing navigations to same-origin has other consequences.  Mainly, it would seem to prevent navigations from following cross origin redirects as they currently do on the web:\r\n\r\n* When a 30x is encountered step 5 of [HTTP Fetch][] recursively calls [Main Fetch][] using the new location.\r\n* Step 8 of [Main Fetch][] checks to see if the current URL is same origin, and if its not it explicitly returns NetworkError for same-origin RequestMode.\r\n\r\nI ran into this while trying to make our navigations same-origin.  We have a test that does `respondWith(fetch(evt.request))` for a navigation request to a cross-origin 308.  This fails when RequestMode is same-origin due the issue above.  When navigations are RequestMode no-cors, then this works.\r\n\r\nNote, currently both chrome and firefox implement navigations as no-cors and block opaque interception using a secondary check.\r\n\r\n[HTTP Fetch]: https://fetch.spec.whatwg.org/#http-fetch\r\n[Main Fetch]: https://fetch.spec.whatwg.org/#main-fetch"},"comment":{"url":"https://api.github.com/repos/whatwg/fetch/issues/comments/128266437","html_url":"https://github.com/whatwg/fetch/issues/101#issuecomment-128266437","issue_url":"https://api.github.com/repos/whatwg/fetch/issues/101","id":128266437,"user":{"login":"annevk","id":1544111,"avatar_url":"https://avatars.githubusercontent.com/u/1544111?v=3","gravatar_id":"","url":"https://api.github.com/users/annevk","html_url":"https://github.com/annevk","followers_url":"https://api.github.com/users/annevk/followers","following_url":"https://api.github.com/users/annevk/following{/other_user}","gists_url":"https://api.github.com/users/annevk/gists{/gist_id}","starred_url":"https://api.github.com/users/annevk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/annevk/subscriptions","organizations_url":"https://api.github.com/users/annevk/orgs","repos_url":"https://api.github.com/users/annevk/repos","events_url":"https://api.github.com/users/annevk/events{/privacy}","received_events_url":"https://api.github.com/users/annevk/received_events","type":"User","site_admin":false},"created_at":"2015-08-06T06:37:49Z","updated_at":"2015-08-06T06:37:49Z","body":"@horo-t no, that change got reverted. See \"main fetch\", step 15."}}