Skip to content

fix!: immutable headers guards for incoming response and downstream request #1006

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 13 commits into
base: main
Choose a base branch
from

Conversation

guybedford
Copy link
Contributor

This implements immutable headers guards for the fetch event request, and any fetch() responses.

With this change, trying to set a header on one of these will throw a TypeError as is correct per the fetch and service worker specs.

Resolves #992.

@guybedford guybedford requested a review from cfallin October 11, 2024 22:24
@guybedford guybedford added the next major Do not land until the next major release label Oct 11, 2024
@guybedford guybedford force-pushed the main branch 4 times, most recently from 6aff377 to 206a60e Compare November 7, 2024 20:35
@guybedford guybedford removed the next major Do not land until the next major release label Dec 2, 2024
@guybedford
Copy link
Contributor Author

This should also reintroduce the "fetch/api/response/response-headers-guard.any.js" WPT test.

@guybedford
Copy link
Contributor Author

This can be done as a minor since there is no functional change, so long as it rebased in a way that respects the Candidate Response phase of the Response permitting mutations (i.e. the definition of is_upstream needs to be tweaked, and the guard needs to change during the lifecycle).

@guybedford guybedford added this to the 4.0.0 milestone Jan 21, 2025
@cfallin
Copy link
Contributor

cfallin commented Jun 6, 2025

Could someone remove me as the requested reviewer? (@sunfishcode?) I'm cleaning up old review requests and still have this one on my queue but no permissions to remove myself or close it anymore.

@cfallin
Copy link
Contributor

cfallin commented Jun 16, 2025

@cceckman-at-fastly @dgohman-fastly as two recent committers, it looks like you have rights to do so -- could you please remove me as a reviewer on this old PR?

@dgohman-fastly dgohman-fastly removed the request for review from cfallin June 16, 2025 14:12
@dgohman-fastly
Copy link

@cfallin I've now removed you as a reviewer.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Backend response headers set issue
3 participants