Re: [whatwg/fetch] More wildcards in CORS when used without credentials (#298)

Also not sure how this all goes together, but I noticed the following two don't match:
https://www.w3.org/TR/cors/#access-control-allow-headers-response-header
https://fetch.spec.whatwg.org/#http-new-header-syntax

Specifically:
Access-Control-Allow-Headers: "Access-Control-Allow-Headers" ":" #field-name (in W3)
Access-Control-Allow-Headers     = #field-name-or-wildcard (in Fetch Spec)

As I was writing this I realized the W3 recommendation was published in Jan 2014, so I guess we'll have to wait for a newer version to be published?

Does the latest fetch spec's definition of Access-Control-Allow-Headers supersede the W3 recommendation?




-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/298#issuecomment-247428907