Re: [fetch] Update Access-Control-Allow-Headers CORS response header to allow * (allow-all) (#251) from Frederik on 2016-03-20 (public-webapps-github@w3.org from March 2016)

From: Frederik <notifications@github.com>
Date: Sun, 20 Mar 2016 13:59:31 -0700
To: whatwg/fetch <fetch@noreply.github.com>
Message-ID: <whatwg/fetch/issues/251/199023188@github.com>

Thanks, @craigfrancis, I concur.
If we allow this (of which I'm not completely convinced yet), we should disallow credentials in the wildcard case. Of course, we should also disallow [*forbidden headers*](https://fetch.spec.whatwg.org/#forbidden-header-name).

---
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/251#issuecomment-199023188

Received on Sunday, 20 March 2016 20:59:58 UTC