Request's mode incorrectly documented

[annevk]

In https://developer.mozilla.org/en-US/docs/Web/API/Request/mode it states

Prevents the method from being anything other than HEAD, GET or POST, and the headers from being anything other than CORS-safelisted request headers.

However, that is incorrect. The only no-CORS headers that are safelisted are here: https://fetch.spec.whatwg.org/#no-cors-safelisted-request-header-name. And that's a subset of the CORS-safelisted requested headers.

This probably came to be when the Range header was added for CORS.

Context: whatwg/fetch#1310 (comment). Credit: @anson0370.

[wbamberg]

Am I right in thinking that https://github.com/whatwg/fetch/blob/1dc1b034b208faf6652dced19954f67717da9ba1/review-drafts/2024-06.bs#L1985-L1988 also ought to be updated?

"no-cors"

Restricts requests to using CORS-safelisted methods and CORS-safelisted request-headers. Upon success, fetch will return an opaque filtered response.

[sideshowbarker]

Am I right in thinking that whatwg/fetch@1dc1b03/review-drafts/2024-06.bs#L1985-L1988 also ought to be updated?

No, that’s the request’s “credentials mode” https://fetch.spec.whatwg.org/#concept-request-credentials-mode, right?

Whereas, no-cors is a value for the request’s “mode” https://fetch.spec.whatwg.org/#concept-request-mode

[wbamberg]

no-cors is a value for the request’s “mode” https://fetch.spec.whatwg.org/#concept-request-mode

That's the bit I quoted (the green note):

Am I misreading it?

[sideshowbarker]

no-cors is a value for the request’s “mode” fetch.spec.whatwg.org#concept-request-mode

That's the bit I quoted (the green note):

Am I misreading it?

You’re not misreading — I just misread your earlier comment…

So yeah, you’re right — that note should be updated