Re: [whatwg/fetch] Vary HTTP cache on credentials mode (#307)

Intermediate proxies can be a problem, yes, but are not in use for most simple sites, which will use increasingly use HTTPS (defeating other kinds of proxies).

I think the bug isn't the omission of `Vary` because 1) `Vary` isn't very reliable 2) it's extremely easy to add a header unconditionally and it's been somewhat widely broadcast that it's safe to do so 3) browsers typically offer defense-in-depth even when sites could have protected themselves better (case in point: intranets).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/307#issuecomment-285118507