Re: [whatwg/fetch] "Prefer: safe" header behavior not defined with respect to CORS (#934)

I think if we wanted to have a normative definition we could add a step prior to step 16 that covers `Prefer: safe` explicitly (and also covers the situation where a site has already set it via `fetch()` or some such). E.g., it'd be interesting to know what happens if a developer sets `Prefer: unsafe` or `Prefer: meh` via `fetch()` or `XMLHttpRequest` on Windows when that preference is set and perhaps we should standardize what ought to happen in such a scenario.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/934#issuecomment-531125660