Re: [whatwg/fetch] Allow setting `cookie` header in credential-less CORS requests (#268)

The reason to do this is that it'll allow us to support a bigger set of HTTP semantics. I.e. we should do this for the same reason that we added Access-Control-Allow-Headers. We didn't have specific requests from authors for that, but it seemed like a good idea to support a larger set of HTTP semantics. Since then we've seen lots of people use it confirming that it was a good idea to add the support.

I think disabling cookies means disabling a pretty big and important part of http. That seems like a bad idea.


---
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/268#issuecomment-216579551