[Not release] HTTP Access-Control-Allow-Header can't be wildcarded for authorization directive

[hamishwillee]

Acceptance Criteria

• The listed features are documented sufficiently on MDN
• BCD is updated
• Interactive example and data repos are updated if appropriate
• The content has been reviewed as needed

For folks helping with Firefox related documentation

• Set bugs to dev-doc-complete
• Add entry to Firefox release notes if feature is enabled in release
• Add entry to Firefox experimental features page if feature is not yet enabled in release

Features to document

I think we might need to add experimental feature behind pref: network.cors_preflight.authorization_covered_by_wildcard

# When the Access-Control-Allow-Headers is wildcard (*), whether to allow
# CORS-protected requests with the Authorization request header.
- name: network.cors_preflight.authorization_covered_by_wildcard

There is also https://bugzilla.mozilla.org/show_bug.cgi?id=1687364#c4 which indicates we might need to update Access-Control-Expose-Headers to remove comments around use of the authorization header.

Querying this in https://bugzilla.mozilla.org/show_bug.cgi?id=1687364#c41

Related Gecko bugs

https://bugzilla.mozilla.org/show_bug.cgi?id=1687364

Other

• Check content open issues to see if any pertain to the subject matter. If there are any that can be closed because of the work, do so. If there are any that can be fixed relatively quickly because of the knowledge from completing this issue and you have time, feel free to go ahead and fix them.
• Check if glossary updates are required for the feature you're documenting - whether an existing term needs to be updated or a new term should be added.
• Check if BCD update means that content pages need to have experimental markup removed or deprecated markup added (front matter tags and macros).

[hamishwillee]

Situation pretty much as I thought: https://bugzilla.mozilla.org/show_bug.cgi?id=1687364#c42

Status:

• BCD - FF115 Access-Control-Allow-Headers - wildcard not include Authorization header browser-compat-data#20092
• Docs
  • Access-Control-Expose-Headers - wildcarded authorization header info incorrect #27263
  • Access-Control-Allow-Headers - no update, describes the expected behaviour already.
• Experimental features - ExprFeat: Access-Control-Allow-Headers wildcard disallow Authorization header #27264
• dev-doc-complete

[mozfreddyb]

FWIW, this behavior is not going to ship with Firefox 115. It's going to be available behind a pref. We're estimating that this may cause compatibility issues and are currently debating a coordinated launch across browser vendors. whatwg/fetch#1278 has more.

[hamishwillee]

Thanks very much @mozfreddyb. That has been captured in the compatibility table and experimental features already.

Note, I definitely do NOT want to discourage this kind of reminder though - I've missed preferenced changes before.

PS Added dev-docs-needed to https://bugzilla.mozilla.org/show_bug.cgi?id=1841019 so we'll get a hint when this ships.