Re: [whatwg/fetch] Safelist request headers starting with `Sec-` (#880)

So the flow you seem to want is that a context can set a `Sec-`-prefixed header on a request and pass that to fetch, rather than pass some data to fetch that fetch then turns into a `Sec-`-prefixed header before hitting the network.

The problem with this approach is service workers. You've now put privileged headers in a `Request` object. Trying to do anything with that `Request` object will get those headers removed due to the way the `Request` constructor operates and https://fetch.spec.whatwg.org/#concept-headers-append in particular which it invokes.

Perhaps that is what should happen as the context is different too, but I strongly suspect it's not what you intended to happen.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/880#issuecomment-473973493