Re: [whatwg/fetch] Allow custom headers on no-cors requests (#380)

Ah I see. Although it sounds like in this case server explicitly wants to change redirect URL based on metadata it received in own request headers, so doesn't seem like vulnerability, rather as a part of the feature (custom response based on request headers).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/380#issuecomment-244331304