Re: [fetch] Update Access-Control-Allow-Headers CORS response header to allow * (allow-all) (#251)

I think `Access-Control-Allow-Headers: *` would be quite easy to get wrong. Websites quite often today simply set a `x-xhr-request: true` header as a CSRF prevention mechanism. If such a website is able to opt in to `Access-Control-Allow-Headers: *` requests with credentials, they are immediately vulnerable to CSRF attacks.

---
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/251#issuecomment-200491377