Re: [whatwg/fetch] CORS-safelisted request-headers and Client Hints (#1006)

The harder to deploy thing is almost certainly a feature, for sure.  I'd say that once software is in place, flipping the switch should be easy, it's the process you might want to follow before you flip the switch that is challenging.

The other concern I've heard is that preflighting (or fetching Origin Policy) is expensive, and a flag in the connection setup would avoid that cost.

Origin Policy has the disadvantage of needing to define a scope over which it applies, with interesting characteristics from a privacy perspective as a result.  On the other hand, it's fairly clear what the scope of applicability for a TLS flag is.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/1006#issuecomment-606402886