Wording suggests that CORS-preflight requests systematically include an Access-Control-Request-Headers header

[jub0bs]

What is the issue with the Fetch Standard?

Section 3.2.2 contains the following passage:

A CORS-preflight request is a CORS request that checks to see if the CORS protocol is understood. It uses OPTIONS as method and includes these headers:

• Access-Control-Request-Method
  Indicates which method a future CORS request to the same resource might use.

• Access-Control-Request-Headers
  Indicates which headers a future CORS request to the same resource might use.

(my emphasis)

This wording suggests that CORS-preflight requests systematically include the two headers in question. However, in reality, CORS-preflight requests systematically contain an Access-Control-Request-Method header and only optionally contain an Access-Control-Request-Headers header.

This ambiguity may lead developers of CORS middleware to misclassify CORS-preflight requests; here is one example.

---

I suggest a reformulation, perhaps something like the following:

A CORS-preflight request is a CORS request that checks to see if the CORS protocol is understood. It uses OPTIONS as method and systematically includes the following header:

• Access-Control-Request-Method
  Indicates which method a future CORS request to the same resource might use.

A CORS-preflight request may also include the following header:

• Access-Control-Request-Headers
  Indicates which headers a future CORS request to the same resource might use.

[annevk]

Wording nits:

1. "and includes the following header"
2. "can also include the following header"

For consistency with the surrounding sections.

[jub0bs]

@annevk Any feedback? Are you happy with my changes? Or did I miss something in the requirements for this PR to get merged?

[annevk]

All good, was just occupied with other things for a bit.