[whatwg/fetch] Add `Last-Event-ID` as CORS-safelisted request-header (#597)

It turns out that you can set the Last-Event-ID request header to arbitrary values and get it across origins. That seems like sufficient reason to safelist it and hopefully make it clear to server administrators to pay extra attention to this header.

Tests: ...

Fixes #568.
You can view, comment on, or merge this pull request online at:

  https://github.com/whatwg/fetch/pull/597

-- Commit Summary --

  * Add `Last-Event-ID` as CORS-safelisted request-header

-- File Changes --

    M fetch.bs (1)

-- Patch Links --

https://github.com/whatwg/fetch/pull/597.patch
https://github.com/whatwg/fetch/pull/597.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/597