On Wed, 01 Apr 2009 12:11:35 +0200, Anne van Kesteren <[email protected]> wrote: > On Wed, 01 Apr 2009 12:05:08 +0200, Alexey Proskuryakov <[email protected]> > wrote: >> As there seems to be no danger in allowing this header for same origin >> requests, I'd suggest removing it from the list of forbidden headers. >> As mentioned in this thread, there are valid reasons to control it >> explicitly. > > Actually, I suppose we can also allow it for cross-origin requests now > the server has to explicitly opt-in for each and every header.
Removed from the list. -- Anne van Kesteren http://annevankesteren.nl/
