Consider setting omit-Origin-header-flag for same origin requests about xhr HOT 8 CLOSED

See also whatwg/fetch#172

from xhr.

So it seems we need something more complicated since a same-origin to cross-origin redirect as initial response would cause the header to be included, right?

from xhr.

I think so. If we adopt the change, i.e. no Origin header for same-origin, we should align Origin header inclusion yes/no with cross origin yes/no. When we enter cross-origin processing state in response to same to cross redirect, we should include the Origin header in the next, now cross-origin, request.

from xhr.

Maybe HTTP-network-or-cache fetch should be passed CORS flag and use it to decide whether or not to append the Origin header.

from xhr.

The problem is that we also use the Origin header for <form method=POST> and some other things? What logic does Blink use at the moment?

from xhr.

It's complicated. @hiroshige-g is checking Blink code to sort it out now.

from xhr.

Related gecko bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1272302

from xhr.

FWIW, this is being fixed by whatwg/fetch#225. We're just obsoleting the need for the flag and instead directly check the methods in use (or the CORS flag).

from xhr.