Re: [whatwg/fetch] If a resource allows credentials but omits Vary, shouldn't responses to non-CORS requests also contain Access-Control-Allow-Credentials? (Issue #1601)

Now that I think about it, a similar consideration involves the `Access-Control-Expose-Headers`.  In the case of a resource that
- systematically includes `Access-Control-Allow-Origin: https://example.com` in all responses,
- omits the `Vary` header (as explained above),
- wishes to expose response headers,

the `Access-Control-Expose-Headers` header should likely be included in all responses, i.e. also to non-CORS requests.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/1601#issuecomment-1420881527
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/fetch/issues/1601/1420881527@github.com>