Re: [whatwg/fetch] Cache-Friendly Access-Control-Allow-Origin (#890)

I'm not a big fan of allowing `*` as it requires defining a detailed parsing and processing model. And where you allow "any" label has some security implications too.

Supporting `same-site` makes sense to me. And perhaps allowing the listing of a registrable domain makes sense too. That would still allow a fairly simple processing model.

Allowing multiple values also makes sense to me and would help various scenarios.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/890#issuecomment-479403344