Re: [fetch] `user-agent` header control (#37)

The header can only be set for fetches that are same-origin or subject to CORS (with a preflight where the server needs to opt into `User-Agent`), same as all developer-set headers. If that still enables attacks I would love to see an example.

---
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/37#issuecomment-90517461