Re: [fetch] Update Access-Control-Allow-Headers CORS response header to allow * (allow-all) (#251)

@annevk, fair point.

My concern is that if we **don't** allow `Access-Control-Allow-Headers: *` on a credentialed request, then this will significantly restrict some really useful new functionality. And as I noted in a **[comment](https://github.com/whatwg/fetch/issues/253#issuecomment-200054071)** in a different (but related) thread, I think that a far greater percentage of CORS requests are credentialed than we might assume.

---
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/251#issuecomment-200484526