Origin outside of CORS and interaction with the Referrer Policy - #14260

Please ignore the lack of DRY for now, that will be cleaned up.

I'm curious about three things myself:

• Why do browsers have the results they do? (Note that the expectations are written to follow what Chrome does.)
• What scenarios do we need to cover? (HTTPS to HTTP isn't covered, affect of referrer policy, if any, isn't covered. Same-origin isn't covered.)
• What changes are needed to step 5.10 of https://fetch.spec.whatwg.org/#concept-http-network-or-cache-fetch to account for the way browsers generate Origin.

@mikewest @youennf @yutakahirano I hope you'll be able to help here.

Hey @JuniorHsu, thanks for taking a look. I removed the detailed descriptions for now as they're mostly wrong and I guess we haven't quite decided what behavior we want anyway. I also found a way to make final test consistently run across browsers (there's a difference between how browsers deal with newly appended frames unfortunately).

Are you still planning on writing more tests around this to figure out what kind of Origin header we want for the non-CORS scenarios?

This PR now includes all @JuniorHsu's great work. Next step is figuring out the spec and then making sure this PR is aligned with what we agree on there and then filing the various implementation bugs required.

If folks want to review the additions meanwhile that'd be great!

@JuniorHsu this now includes your fetch() test and I rebased on master so that the latest tooling is used when building.

Did you get closer with the intermittent issue in Firefox? Will you work on splitting this test?

@JuniorHsu this now includes your fetch() test and I rebased on master so that the latest tooling is used when building.

Did you get closer with the intermittent issue in Firefox? Will you work on splitting this test?

I send another PR
#17407