[whatwg/fetch] If a resource allows credentials but omits Vary, shouldn't response to non-CORS requests also contain ACAC? (Issue #1601)

While completing the test suite of [my CORS middleware library](https://pkg.go.dev/github.com/jub0bs/fcors), I ran into an interesting case. The [section entitled _CORS protocol and HTTP caches_](https://fetch.spec.whatwg.org/#cors-protocol-and-http-caches) says the following:

> However, if `Access-Control-Allow-Origin` is set to `*` or a static origin for a particular resource, then configure the server to always send `Access-Control-Allow-Origin` in responses for the resource — for non-CORS requests as well as CORS requests — and do not use `Vary`.

In the case of a single static origin (not the wildcard), if the resource allows credentials, shouldn't responses to non-CORS requests also contain `Access-Control-Allow-Credentials: true`?

Otherwise, a response to a non-CORS requests lacking that header could get cached, and subsequently get served by the cache in response to a credentialed request; this situation would cause the CORS check to fail.

Unless I'm missing something, perhaps this consideration deserves a mention in the standard.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/1601

You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/fetch/issues/1601@github.com>