Re: [w3ctag/design-reviews] Migrating some high-entropy HTTP request headers to Client Hints. (#320)

@annevk: Good question. I'm blindly assuming that whatever the Client Hints folks work out for CORS will make sense for these headers too. I kinda haven't been following along with that conversation... :( Perhaps @yoavweiss has?

I recall that you and I discussed something along these lines for the CSP:EE work, and you suggesting that the `Sec-` prefix somewhat mitigated your concerns, though not entirely. I wonder if something like `Sec-CH-` would be a reasonable pattern to adopt for hints generally... Hrm.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/design-reviews/issues/320#issuecomment-435874298