| 18:26 | <__an0n> | annevk: hello, could you take a look at https://github.com/whatwg/fetch/issues/252#issuecomment-269131852 ? |
| 18:29 | <__an0n> | just want a confirmation |
| 18:30 | <__an0n> | if anyone else knows… |
| 18:34 | <__an0n> | that sentence: |
| 18:34 | <__an0n> | > Similarly, `Access-Control-Expose-Headers`, `Access-Control-Allow-Methods`, and `Access-Control-Allow-Headers` response headers can only use `*` as value when request’s credentials mode is not "include". |
| 18:36 | <__an0n> | makes me think that you can have a request mode "cors" and credentials "same-origin" which would have a Access-Control-Expose-Headers field value of "*" |
| 18:36 | <__an0n> | is that correct? |
| 18:51 | <__an0n> | no one has any idea? |
| 19:01 | <__an0n> | In short it seems that https://github.com/whatwg/fetch/commit/cdbb13c08650b10c9ebfc54d046bec0639e7ba7c contradicts this sentences fromt the spec: |
| 19:01 | <__an0n> | > Similarly, `Access-Control-Expose-Headers`, `Access-Control-Allow-Methods`, and `Access-Control-Allow-Headers` response headers can only use `*` as value when request’s credentials mode is not "include". |
| 19:02 | <__an0n> | one says only omit, the other omit and same-origin |
| 19:08 | <__an0n> | someone could redirect me to the proper channel? (clearly I am not on the right one) |
| 20:26 | <annevk> | Well, it is a holiday… |