Consider using a Fetch metadata header

[letitz]

We might want to let the server know that the request client is in a more public network, during the actual request, after the preflight request. This could take the shape of a fetch metadata header. Something like:

Sec-Fetch-Address-Space: public

Modulo the appropriate amount of bikeshedding.

According to @mikewest in #80, some version of this was considered way back when CORS-RFC1918 was being initially designed.

[annevk]

If we do this we should probably only include it for non-public requests to avoid bloat in the common case.

[letitz]

Agreed! The default (not a private network request) can be implied by the absence of the header.

[mikewest]

Right. If we decide we need it, we'd want to model it on https://www.w3.org/TR/fetch-metadata/#sec-fetch-user-header.

That said, I'm not sure we do. I think it's worth discussing, but no one we've talked to has asked for this. It might have just been an unnecessary idea way back when.