Re: [fetch] Add new Access-Control-Suppress-Headers CORS response header (#253)

For requests without credentials, any header can easily be read by simply using a non-browser HTTP client.

I.e. I can use wget to make any URL from any server, using any method and any headers that I want. And I can read the full response including all response headers.

The only thing I can't do, is make that request with your cookies.

---
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/253#issuecomment-200098479