Re: [whatwg/fetch] More wildcards in CORS when used without credentials (#298)

@annevk I think the second example in section 4.2.6 should have the last line changed to something like this:

> This is because bar.invalid needs to explicitly share each header by listing their names in the `Access-Control-Expose-Headers` response header. Alternatively, bar.invalid could have returned `Access-Control-Expose-Headers: *` which would share all response headers.

Basically showing developers that they can specify `Access-Control-Expose-Headers: *`.

---
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/298#issuecomment-218930527