Re: [fetch] Update Access-Control-Allow-Headers CORS response header to allow * (allow-all) (#251) from Anne van Kesteren on 2016-03-23 (public-webapps-github@w3.org from March 2016)

From: Anne van Kesteren <notifications@github.com>
Date: Wed, 23 Mar 2016 11:22:32 -0700
To: whatwg/fetch <fetch@noreply.github.com>
Message-ID: <whatwg/fetch/issues/251/200478300@github.com>

FWIW, no need to have an issue/PR per example, one for all is fine too. Getting W3C to acknowledge reality is going rather slow, see https://github.com/whatwg/fetch/issues/204#issuecomment-184257430 for progress on that.

@roryhewitt I don't think the problem is that allowing it opens security holes, it's that it makes the handshake simpler and it's unclear that we want the credentialed handshake to be simple.

---
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/251#issuecomment-200478300

Received on Wednesday, 23 March 2016 18:23:15 UTC