Re: [whatwg/fetch] Allow setting `cookie` header in credential-less CORS requests (#268)

Apart from the `curl` argument, as mentioned in the initial comment, `cookie` wouldn't be a simple header. So websites would still have to explicitly opt-in to enabling third parties to send a `cookie` header, the same way that they currently can opt in to enabling third to send a `authorization` header.

---
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/268#issuecomment-205815492