On: Shared Cache Is Going Away

[gregable]

What if:

a) the origin sharing the resource must place a .well_known/static_resource file in place.

b) The presence of .well_known/static_resource prevents any request on this origin to send cookies, and any set-cookie header is ignored.

c) The document that includes the resource on this sharing origin must use subresource integrity attributes when loading the shared resource.

d) the resource cannot be cached unless the cache-control header is public and has a lifetime of at least 1 hour.

This guarantees that the resource is always requested cookieless, and that the resource can't vary per request, otherwise the subresource integrity check would fail.

[progval → gregable]

Why .well_known/ instead of HTTP headers (possibly on a HEAD request beforehand, like CORS)?

[gregable → progval]

To ensure the entire origin had the same policy. Perhaps that's unnecessary though.