Re: [whatwg/fetch] More wildcards in CORS when used without credentials (#298)

>  Access-Control-Allow-Credentials = %x74.72.75.65 ; "true", case-sensitive
> -Access-Control-Expose-Headers    = #<a class="external" data-anolis-spec="http" href="https://tools.ietf.org/html/rfc7230#section-3.2">field-name</a>
> +Access-Control-Expose-Headers    = field-name-or-wildcard
> +field-name-or-wildcard           = <a class="external" data-anolis-spec="http" href="https://tools.ietf.org/html/rfc7230#section-3.2">field-name</a> / wildcard

Yeah, it probably doesn't make sense to allow either here.

---
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/298/files/487cc8504ec70f4d2a6741f0fd2b494981690ffe#r62495264