Re: [whatwg/fetch] Add `Last-Event-ID` to CORS-safelisted request headers (PR #1788)

rexxars left a comment (whatwg/fetch#1788)

> In principle this is ready to land in the specification, but I'm a little worried that the browser patches don't seem to account for `EventSource` also having to go through this code path. We don't just want to safelist this header. We also want to make sure the existing use of this header abides by the safelist rules.

I realized this myself after your feedback on the WebKit change, thank you for that. I will go through each of the patches and ensure that they test both safe and non-safe `last-event-id` values for both fetch, XMLHttpRequest and EventSource - and ensure that the new WPT tests fail before the change and pass after the change. Will revisit once I've done that.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/1788#issuecomment-2741132409
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/fetch/pull/1788/c2741132409@github.com>