Add Last-Event-ID to CORS-safelisted request headers

[rexxars]

Since EventSource implementations in most environments already send this header without CORS preflight request, it makes sense to make it a safe-listed header.

See #568 for more background.

• At least two implementers are interested (and none opposed):
  • WebKit
  • …
• Tests are written and can be reviewed and commented upon at:
  • Add Last-Event-ID to CORS-safelisted headers web-platform-tests/wpt#49257
• Implementation bugs are filed:
  • Chromium: …
  • Gecko: …
  • WebKit: …
• MDN issue is filed: …
• The top of this comment includes a clear commit message to use.

(See WHATWG Working Mode: Changes for more details.)

---

Preview | Diff

[annevk]

@yoichio @KershawChang @youennf any final thoughts?

[annevk]

Please add your name to the Acknowledgments section! (Not required.)

[rexxars]

Please add your name to the Acknowledgments section! (Not required.)

Thanks! Done :)

[smaug----]

Gecko is interested, but how likely will this cause some webcompat issues?

Is #568 (comment) about the relevant change? Those numbers are going up, but still rather low.

Edit: looks like it was discussed here #568 (comment)