[whatwg/fetch] vague spec result in Firefox security hole (#871)

Firefox `fetch` is not longer sending CORS header with HEAD or even GET requests
because of vague verbiage here:

https://github.com/whatwg/fetch/blob/4defab749e723dc367819363a3339db8c9ec611c/fetch.bs#L2412-L2416

https://github.com/whatwg/fetch/blob/4defab749e723dc367819363a3339db8c9ec611c/fetch.bs#L4145-L4149

https://bugzilla.mozilla.org/show_bug.cgi?id=1508661


-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/871