Re: [fetch] Update Access-Control-Allow-Headers CORS response header to allow * (allow-all) (#251)

@annevk, so the attack @sicking mentioned is only an issue if `Access-Control-Allow-Origin: *` is used, correct? So if the site is set up to return `Access-Control-Allow-Origin: <value-of-Origin-header>`, then this isn't a concern, with or without credentials? Or am I misunderstanding?

@sicking, I hope it doesn't sound like I'm attacking you - when I get the 'bit between my teeth', I tend to start trying to poke holes and cause trouble. If any of this comes off that way, my apologies.

---
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/251#issuecomment-200967905