Re: [fetch] Add new Access-Control-Suppress-Headers CORS response header (#253)

In [this](#issuecomment-199950058) comment I said I'm fine with adding `Access-Control-Expose-Headers: *`. I don't really have a strong opinion about if we add it only for credential-less requests, or for all requests.

I don't think we should add `Access-Control-Exclude-Headers`. It's a convenience feature to support a use case which seems rare to me, and which is already supported through multiple other means as listed [here](#issuecomment-200013535).

All of these other ways seems more security-wise sound and have the advantage that they work on existing browsers.

---
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/253#issuecomment-200264122