Re: [whatwg/fetch] CORS: arbitrary blocking of accept header based on length (#862)

Ok, I confirm that with 128 bytes accept header it works, 129 bytes doesn’t work.

```javascript
fetch('https://graph.irail.be/sncb/connections?departureTime=2019-01-27', 
   {
      headers: new Headers({
          accept: "application/trig;q=1.0,application/n-quads;q=0.7,text/turtle;q=0.6,application/n-triples;q=0.3,application/ld+json,text/n3;q=0.2" //this one is 128 bytes
      })
   }).then(async (response)=> { console.log(await response.json())});
```

So when the accept header is larger than 128 bytes, a preflight request happens, where the accept header needs to be explicitly mentioned in the `access-control-allow-headers`?

For open datasets, we should thus start adding to all servers (even when just files) next to an `access-control-allow-origin: *` header also
 1. an `access-control-allow-headers: *`, and
 2. make sure these handle OPTIONS requests?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/862#issuecomment-458516496