[whatwg/fetch] The guard of headers created from no-cors (#1074)

In https://fetch.spec.whatwg.org/#dom-request, we set request's headers guard to "request" if _init_ is empty, even when created from a no-cors request. This allows web developers to modify headers that are not CORS-safelisted.

This seems like a spec bug.

See also: #560

@youennf @annevk @jakearchibald 



-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/1074