- From: Anne van Kesteren <notifications@github.com>
- Date: Mon, 06 Jun 2016 01:06:03 -0700
- To: whatwg/fetch <fetch@noreply.github.com>
- Cc:
Received on Monday, 6 June 2016 08:06:32 UTC
I know from https://lists.w3.org/Archives/Public/public-webappsec/2016May/0034.html that there's at least some security folks wanting to restrict the existing CORS-safelisted request-headers (e.g., `Accept`) to some set of limited values too. The reason we restricted the values for these new headers is that Chrome was already violating the same-origin policy for them, with `<img>` et al, but only with valid values. So letting `fetch()` do the same for valid values seemed reasonable and this passed security review. --- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/whatwg/fetch/issues/313#issuecomment-223893137
Received on Monday, 6 June 2016 08:06:32 UTC