Re: [whatwg/fetch] No documentation on how a server must response to a wrong CORS-headers-request. (#1102)

Thanks, @annevk.  So there shouldn't be any security concern with an implementation returning CORS response headers even when one of the `Access-Control-Request-Headers` values is not allowed, or when the `Access-Control-Request-Method` method is not allowed.  It's just a hint to the server that's most helpful in the case of unbounded allowed values.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/1102#issuecomment-933648420