Re: [whatwg/fetch] Safelist Last-Event-ID (#568)

That is great news! Here is what we need to do specification-wise:

1. Update https://fetch.spec.whatwg.org/#cors-safelisted-request-header to list `last-event-id` right below `accept` so it ends up sharing the same algorithm.
2. Update corresponding tests.
3. Add a comment to https://github.com/whatwg/html/issues/7363 indicating that HTML should probably also document that certain values result in a CORS preflight. (Fixing that issue would be a nice stretch goal.)

I suspect that all implementers are on board aligning here given that it currently represents a hole in our same-origin policy protections.

cc @youennf @KershawChang

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/568#issuecomment-1157351952
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/fetch/issues/568/1157351952@github.com>