Re: [whatwg/fetch] Listing headers safe only for certain values is a bad idea (#313)

Sorry for joining late. We are moving the https://github.com/whatwg/fetch/issues/382 discussion here.

@sicking I read your position as "Browser restrictions on CORS header values 1) will make servers rely on them and thus result in poor server input validation, and 2) will result in more security bugs filed against browsers." True?

Servers that depend on browser enforced header values might as well result in _better_ server-side input validation, right? For the Content-Type header, the current restriction might as well result in the server comparing with an enum and accepting nothing else.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/313#issuecomment-245347386