Re: [fetch] Update Access-Control-Allow-Headers CORS response header to allow * (allow-all) (#251)

I can't think of any problems with `Access-Control-Allow-Headers: *` being allowed on **credentialed** requests (on the basis that `Access-Control-Allow-Origin: *` is still blocked, and provides the protection).

I still prefer that we start with it only being available on **non-credentialed** requests, just so all 3 headers work in the same way.

This would be much easier for browsers to accept and implement (because you're matching how it works already). Whereas if you allowed it on **credentialed** requests as well, I think we will need a lot more people to check this over (just to make sure we haven't missed anything).

---
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/251#issuecomment-200756460