Re: [fetch] Add new Access-Control-Suppress-Headers CORS response header (#253)

@sicking, maybe I'm confused, but surely I can use cURL to make a cross-domain GET request passing/receiving cookies (also passing the requisite CORS headers and responding appropriately to the preflight OPTIONS request/response)? In that case, wouldn't I be able to see any GET response headers, regardless of what value might be returned in Access-Control-Expose-Headers?

At any rate, I'd prefer to allow `Access-Control-Expose-Headers: *` on both credentialed and non-credentialed requests. I think if we only allow it for credentialed requests, it will be too restrictive.

---
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/253#issuecomment-200468442