Re: [whatwg/fetch] Access-Control-Expose-Headers: * can be interpreted in two ways (#548)

#592 is my newly proposed model. Basically using * never leads to an error as it's a valid value. And if the header takes comma-separated values than it's fine for * to just be one of the values per earlier comment.

As mentioned earlier the only limitation is that you cannot solely safelist a header name or method that is `*` for requests without credentials, but that's not a big deal as it's a rather questionable character for that purpose anyway.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/548#issuecomment-326234043