diff --git a/xep-0363.xml b/xep-0363.xml
index 8ec17646..c3a165f0 100644
--- a/xep-0363.xml
+++ b/xep-0363.xml
@@ -343,6 +343,7 @@ Access-Control-Allow-Methods: OPTIONS, HEAD, GET, PUT
 Access-Control-Allow-Headers: Authorization, Content-Type
 Access-Control-Allow-Credentials: true
 ]]></code>
+  <p>Clients SHOULD NOT interpret headers and treat them as opaque.</p>
 </section1>
 <section1 topic='Security Considerations' anchor='security'>
   <section2 topic="Server side" anchor="server">