Re: [whatwg/fetch] CORS: arbitrary blocking of accept header based on length (#862) from Ruben Verborgh on 2019-02-06 (public-webapps-github@w3.org from February 2019)

From: Ruben Verborgh <notifications@github.com>
Date: Wed, 06 Feb 2019 04:54:37 -0800
To: whatwg/fetch <fetch@noreply.github.com>
Cc: Subscribed <subscribed@noreply.github.com>
Message-ID: <whatwg/fetch/issues/862/461013016@github.com>

> As a result from the update in this spec, they would also start advocating for `Access-Control-Allow-Headers: *`

Unfortunately, that does not work: Firefox 65 will not accept `*` but requires the `Accept` header to be listed explicitly, whereas Chrome currently accepts it.

This is very problematic.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/862#issuecomment-461013016

Received on Wednesday, 6 February 2019 12:54:59 UTC