Re: [whatwg/fetch] "With Credentials" flag possibly inconsistent with web architecture (#517)

I still don't understand. You're conflating values of response headers (`Access-Control-Allow-Origin`) with attributes that are only controlled by the client (`withCredentials`). The server doesn't get to dictate whether the client included credentials in the request, that's not possible.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/517#issuecomment-301430701