Re: [whatwg/fetch] Allow setting `cookie` header in credential-less CORS requests (#268)

Well, one reason is that the network layer adds the cookies to the request. If the API layer can add cookies too, that would somehow need to be reconciled. The way that works with `Authorization` is that if the API layer sets it, the network layer basically doesn't set it.

Another reason is that we decided not to expose cookies in XMLHttpRequest based on discussion with @abarth et al. 

There does seem to be some revived interest in doing all kinds of things with cookies, e.g., https://github.com/bsittler/async-cookies-api, so maybe we should reconsider the interactions Fetch has with cookies.

@mikewest, thoughts?

---
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/268#issuecomment-205208842