Access-Control-Request-Method error handling

[mnot]

In the latest HTTP Archive dump (September, desktop), ACRM appears in 346,135 responses (out of more than 528 million).

30,680 of them (8.142%) don't parse well. AFAICT that's overwhelming because people list multiple methods; e.g.,

GET,HEAD
GET, POST , OPTIONS ,PUT, DELETE, PATCH
OPTIONS,GET,POST
POST, OPTIONS

and so forth.

The spec text regarding parsing this header is pretty thin, AFAICT.

[annevk]

Do you mean Access-Control-Allow-Methods? Why would you put ACRM on a response? It would get ignored.

https://fetch.spec.whatwg.org/#http-new-header-syntax has the expected syntax. Improving upon that (by defining parsers similar to what is done for Content-Type and such) is tracked in #814.

[mnot]

Ah - I'm just seeing a bunch of folks adding the wrong header to responses :) Never mind.