[whatwg/fetch] Add `Set-Cookie` as a forbidden header name (PR #1453)

Following a suggestion from @annevk in #973, this adds `set-cookie` as a
forbidden request header name. The rationale here is to prevent complication of
internal data structures for internal header lists that are attached to
`Request` objects, in light of #1346.

I added a UseCounter to Chromium in January to check that this is a web
compatible change. The analysis uncovered no issues, and as such I consider that
this change is web compatible. See
https://github.com/whatwg/fetch/issues/973#issuecomment-1154958094 for more
elaboration.

- [ ] At least two implementers are interested (and none opposed):
   * Deno
   * …
- [ ] [Tests](https://github.com/web-platform-tests/wpt) are written and can be reviewed and commented upon at:
   * …
- [ ] [Implementation bugs](https://github.com/whatwg/meta/blob/main/MAINTAINERS.md#handling-pull-requests) are filed:
   * Chrome: …
   * Firefox: …
   * Safari: …
   * Deno (not for CORS changes): …

(See [WHATWG Working Mode: Changes](https://whatwg.org/working-mode#changes) for more details.)

You can view, comment on, or merge this pull request online at:

  https://github.com/whatwg/fetch/pull/1453


-- Commit Summary --

  * Add `Set-Cookie` as a forbidden header name

-- File Changes --

    M fetch.bs (1)

-- Patch Links --

https://github.com/whatwg/fetch/pull/1453.patch

https://github.com/whatwg/fetch/pull/1453.diff


-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/1453

You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/fetch/pull/1453@github.com>