Re: [whatwg/fetch] Allow custom headers on no-cors requests (#380)

A new potential attack I see is that if an attacker somehow gets to add request headers and those request headers do something at the redirect level (or turn a response into a redirect) there's a new vulnerability of sorts that you cannot have today. Not sure how much of a deal-breaker that should be.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/380#issuecomment-244295693