[Webkit-unassigned] [Bug 189888] New: Change default credentials mode for module scripts from omit to same-origin

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=189888

            Bug ID: 189888
           Summary: Change default credentials mode for module scripts
                    from omit to same-origin
           Product: WebKit
           Version: Safari 11
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: HTML DOM
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: domfarolino at gmail.com
                CC: cdumez at apple.com

The HTML Standard is changing such that module scripts (<script type=module>), and their descendants are fetched with "same-origin" credentials mode [1]. This means credentials must be included on same-origin module scripts requests by default. See point (1) in the following HTML PR: https://github.com/whatwg/html/pull/3656#issuecomment-421589162. Some of the other points in that PR are pending spec finalization, and a separate issue should be filed for them.

[1]: https://fetch.spec.whatwg.org/#concept-request-credentials-mode

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20180922/ad1fe79e/attachment.html>