XMLHttpRequest objects can have their behavior controlled by feature policy
(https://github.com/whatwg/xhr/pull/177, not merged yet)
If the policy in the active document disallows the 'sync-xhr' feature, then calling .send() on the XMLHttpRequest object should throw a NetworkError (and ideally log a message to the developer console)
GitHub issue: https://github.com/whatwg/xhr/issues/178
Web Platform Tests: https://wpt.fyi/xhr/xmlhttprequest-sync-default-feature-policy.sub.html
Feature policy itself has been partially implemented as part of https://bugs.webkit.org/show_bug.cgi?id=167430, but I haven't found another bug for the rest of the implementation. Let me know if I should file that as well.
I guess that if there are other bugs related to feature policy that are filed, maybe having an umbrella bug might be useful.
The current feature policy "implementation" is minimal in that it only checks for the iframe attribute, (no headers checking) and is specific to media capture.
Thanks, Youenn --- I filed https://bugs.webkit.org/show_bug.cgi?id=183300; I'm not sure if bugzilla allows me to declare a dependency of this bug on that one.