diff --git a/fetch.bs b/fetch.bs index b098f431b..399925029 100644 --- a/fetch.bs +++ b/fetch.bs @@ -2526,7 +2526,7 @@ response header can be used to require checking a request<

Its value ABNF:

-Cross-Origin-Resource-Policy     = %x73.61.6D.65 / %x73.61.6D.65.2D.73.69.74.65 ; "same" / "same-site", case-sensitive
+Cross-Origin-Resource-Policy = %x73.61.6D.65.2D.6F.72.69.67.69.6E / %x73.61.6D.65.2D.73.69.74.65 ; "same-origin" / "same-site", case-sensitive

To perform a cross-origin resource policy check, given a request and response, run these steps:

@@ -2550,11 +2550,11 @@ Cross-Origin-Resource-Policy = %x73.61.6D.65 / %x73.61.6D.65.2D.73.69.74.65 `Cross-Origin-Resource-Policy` and response's header list. -

This means that `Cross-Origin-Resource-Policy: same-site, same` ends up - as allowed below as it will never match anything. Two or more +

This means that `Cross-Origin-Resource-Policy: same-site, same-origin` + ends up as allowed below as it will never match anything. Two or more `Cross-Origin-Resource-Policy` headers will have the same effect. -

  • If policy is `same`, then return blocked. +

  • If policy is `same-origin`, then return blocked.

  • If request's origin's host is same site with request's current url's host, then return