Re: [cors] Should browsers send non-user-controllable headers in Access-Control-Request-Headers?

On Wed, Dec 21, 2011 at 9:16 PM, Benson Margulies <bimargulies@gmail.com>wrote:

> Chrome sends:
>
> Access-Control-Request-Headers:Origin, Content-Type, Accept
>
> Is that just wrong?
>
>
The spec clearly says:  "author request headers: A list of headers set by
authors for the request. Empty, unless explicitly set."  So WebKit

For me, Chrome 16 sends Origin + <all_my_specified_headers>, so Chrome is
behaving incorrectly.  Safari 5.1.2 behaves correctly (though the header
list is not lowercased), and Firefox behaves correctly.