Re: [whatwg/fetch] Accept 'sec-'-prefixed headers as CORS-safelisted. (#1000)

I tried to write a patch to address my comment, but while doing so I discovered another problem. Namely, https://fetch.spec.whatwg.org/#cors-unsafe-request-header-names. And it's really two problems: 

1. With enough `Sec-` headers the 1024 limit would get breached.
2. As currently written we'd ask the server to safelist `Sec-` headers, which doesn't make a lot of sense.

I suspect we don't want to change https://fetch.spec.whatwg.org/#cors-safelisted-request-header after all, but only want to change https://fetch.spec.whatwg.org/#cors-unsafe-request-header-names which is what ends up being used. However, we need to think through the value limit problem a bit.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/1000#issuecomment-598674925