Imprecise Access-Control-Request-Headers examples give practitioners false expectations

[jub0bs]

MDN URL

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Request-Headers

What specific section or headline is this issue about?

Directives and Examples

What information was incorrect, unhelpful, or incomplete?

The text and examples are misleading about the laxity of the format that the Fetch standard imposes on the Access-Control-Request-Headers header. This lack of precision can trip practitioners up: rs/cors#176

What did you expect to see?

The Fetch standard requires browsers to construct a sorted list of unique, comma-delimited, byte-lowercase tokens corresponding to the CORS-unsafe request-header names. The text and the examples should reflect that.

Do you have any supporting links, references, or citations?

• https://fetch.spec.whatwg.org/#cors-unsafe-request-header-names
• https://fetch.spec.whatwg.org/#convert-header-names-to-a-sorted-lowercase-set

Do you have anything more you want to share?

Other pages of MDN Web Docs are affected.