Re: [w3ctag/design-reviews] "With Credentials" flag possibly inconsistent with web architecture (#76)

> > IIRC there was an issue with some browser on handling Vary in cache
>
> Browser bugs are not a reason to introduce a new feature (and new bugs).

Of course, this was just a side-comment on the use of Vary, not related to this issue.

> Given that there's plenty of servers using * that seems false. (Note also that just echoing the origin is not insecure. It's only insecure if you also set the ACAC header.)

It is a sign that `*` works in the vast majority of the cases, which is a good thing.


-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/design-reviews/issues/76#issuecomment-353006116