Re: [whatwg/fetch] Strengthen requirements on CORS-safelisted request-headers (#736)

annevk commented on this pull request.



> +            * interesting test: "Content-Type: text/plain;" -->
+
+   <dt>`<code><a href=http://httpwg.org/http-extensions/client-hints.html#dpr>DPR</a></code>`
+   <dt>`<code><a href=http://httpwg.org/http-extensions/client-hints.html#downlink>Downlink</a></code>`
+   <dt>`<code><a href=http://httpwg.org/http-extensions/client-hints.html#save-data>Save-Data</a></code>`
+   <dt>`<code><a href=http://httpwg.org/http-extensions/client-hints.html#viewport-width>Viewport-Width</a></code>`
+   <dt>`<code><a href=http://httpwg.org/http-extensions/client-hints.html#width>Width</a></code>`
+   <dd><p>If <var>value</var>, <a lt="extract header values">once extracted</a>, is failure, then
+   return false.
+
+   <dt>Otherwise
+   <dd><p>Return false.
+  </dl>
+
+ <li><p>If <var>value</var>'s <a for="byte sequence">length</a> is greater than 128, then return
+ false.

Yeah, if we keep adding headers to this safelist that would indeed become a concern. Otherwise I was thinking that a low enough individual limit would make that unneeded.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/736#discussion_r190845942