Fetch Metadata Request Headers

[annevk]

Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1508292.

See whatwg/fetch#700. Also mentioned in #80. Concerns mentioned in that issue:

My concern with that header is that it makes referrer leaking worse, unless we restrict it to revealing one of same-origin, same-site, or cross-site.

Another concern is that it's yet another request header. It could perhaps be made opt-in, but that requires new infrastructure that hasn't materialized yet. As such I don't think this is something we can or want to do soon.

[jonathanKingston]

@annevk should this be renamed to fetch metadata? Also can decide if there are more issues? The TAG closed their review and have been addressed: w3ctag/design-reviews#280

[annevk]

Someone will have to decide whether the additional fingerprinting bits and increase in request headers is worth it.

I'm quite convinced some of this is very useful for sites to protect their resources though.

I wonder if we could perhaps not expose "destination" and expose the main relevant bit that has through mode instead: w3c/webappsec-fetch-metadata#16.

[annevk]

As an update, various security folks at Mozilla have discussed this more and Mozilla is positive on this, with the caveat that there's a couple outstanding issues still that need to be sorted.