[whatwg/fetch] Accept 'sec-'-prefixed headers as CORS-safelisted. (#1000)

As discussed in #993.

@yoavweiss: Is there a better bug that we should link this to? I know you've had a lot of conversations on this topic.

@annevk: I'm not entirely sure how best to phrase this. I was hoping for some mechanics in infra... is "begins with the string XXX" good enough, or should I be more explicit?

Thanks!
You can view, comment on, or merge this pull request online at:

  https://github.com/whatwg/fetch/pull/1000

-- Commit Summary --

  * Accept 'sec-'-prefixed headers as CORS-safelisted.

-- File Changes --

    M fetch.bs (13)

-- Patch Links --

https://github.com/whatwg/fetch/pull/1000.patch
https://github.com/whatwg/fetch/pull/1000.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/1000