{"action":"created","issue":{"url":"https://api.github.com/repos/whatwg/fetch/issues/251","repository_url":"https://api.github.com/repos/whatwg/fetch","labels_url":"https://api.github.com/repos/whatwg/fetch/issues/251/labels{/name}","comments_url":"https://api.github.com/repos/whatwg/fetch/issues/251/comments","events_url":"https://api.github.com/repos/whatwg/fetch/issues/251/events","html_url":"https://github.com/whatwg/fetch/issues/251","id":141746708,"number":251,"title":"Allow * for Access-Control-Allow-Headers and Access-Control-Allow-Methods","user":{"login":"roryhewitt","id":11558891,"avatar_url":"https://avatars.githubusercontent.com/u/11558891?v=3","gravatar_id":"","url":"https://api.github.com/users/roryhewitt","html_url":"https://github.com/roryhewitt","followers_url":"https://api.github.com/users/roryhewitt/followers","following_url":"https://api.github.com/users/roryhewitt/following{/other_user}","gists_url":"https://api.github.com/users/roryhewitt/gists{/gist_id}","starred_url":"https://api.github.com/users/roryhewitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/roryhewitt/subscriptions","organizations_url":"https://api.github.com/users/roryhewitt/orgs","repos_url":"https://api.github.com/users/roryhewitt/repos","events_url":"https://api.github.com/users/roryhewitt/events{/privacy}","received_events_url":"https://api.github.com/users/roryhewitt/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":43,"created_at":"2016-03-18T01:09:33Z","updated_at":"2016-04-19T04:51:54Z","closed_at":null,"body":"This has almost certainly been discussed before, but would it be possible to allow * (allow-all) as a separate value for the **Access-Control-Allow-Headers** CORS response header?\r\n\r\nThis would allow _all_ non-simple headers passed in the request to be added to the browser's preflight cache. This si currently possible by simply mirroring back the value of the **Access-Control-Request-Headers** request header, but this would be much simpler. The browser would need to track the request headers passed and add them all to their preflight cache (rather than simply parse them out from the **Access-Control-Allow-Headers** response header, assuming that's what they currently do), but that's not too hard to do.\r\n\r\nSo the spec would become the following:\r\n\r\nAccess-Control-Allow-Headers = \"Access-Control-Allow-Headers\" \":\" #field-name | \"*\""},"comment":{"url":"https://api.github.com/repos/whatwg/fetch/issues/comments/211728208","html_url":"https://github.com/whatwg/fetch/issues/251#issuecomment-211728208","issue_url":"https://api.github.com/repos/whatwg/fetch/issues/251","id":211728208,"user":{"login":"tyoshino","id":4511440,"avatar_url":"https://avatars.githubusercontent.com/u/4511440?v=3","gravatar_id":"","url":"https://api.github.com/users/tyoshino","html_url":"https://github.com/tyoshino","followers_url":"https://api.github.com/users/tyoshino/followers","following_url":"https://api.github.com/users/tyoshino/following{/other_user}","gists_url":"https://api.github.com/users/tyoshino/gists{/gist_id}","starred_url":"https://api.github.com/users/tyoshino/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tyoshino/subscriptions","organizations_url":"https://api.github.com/users/tyoshino/orgs","repos_url":"https://api.github.com/users/tyoshino/repos","events_url":"https://api.github.com/users/tyoshino/events{/privacy}","received_events_url":"https://api.github.com/users/tyoshino/received_events","type":"User","site_admin":false},"created_at":"2016-04-19T04:51:54Z","updated_at":"2016-04-19T04:51:54Z","body":"The above comment was reporting the fact too roughly. I'd like to correct.\r\n\r\n(The number of pages Chrome users visited that used sync or async XHRs that are both cross-origin and with withCredentials set) / ((The number of pages Chrome users visited that used async XHRs) + (The number of pages Chrome users visited that used sync XHRs)) = ~30%"}}