Re: [whatwg/fetch] Mark Accept-* request headers as simple / safe (#326)

1. To determine whether harm can be done with `Accept-*`, one would theoretically have to study all servers in existence.
2. Per the current standard if you reply to the *preflight* with an appropriate 200, you can reply to the actual request with a 302. We'll then issue another preflight for the new location, and so on. I recommend encouraging browser vendors to implement this.

---
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/326#issuecomment-227963423