Method set

modules/llrt_fetch/src/headers.rs:190–248

(&mut self, ctx: Ctx<'js>, key: String, value: Value<'js>)

    }

    pub fn set<'js>(&mut self, ctx: Ctx<'js>, key: String, value: Value<'js>) -> Result<()> {
        let key = lower_key(key);
        if !is_http_header_name(&key) {
            return Err(Exception::throw_type(&ctx, "Invalid key"));
        }
        if self.guard == HeadersGuard::Immutable {
            return Err(Exception::throw_type(&ctx, "Headers are immutable"));
        }
        if matches!(
            self.guard,
            HeadersGuard::Request | HeadersGuard::RequestNoCors
        ) && is_forbidden_request_header(&key)
        {
            return Ok(());
        }
        if self.guard == HeadersGuard::Response && key.as_ref() == SET_COOKIE.as_str() {
            return Ok(());
        }

        let mut value = coerce_to_string(&ctx, value)?;
        // Reject values containing null bytes or bare CR/LF;
        // `normalize_header_value_inplace` silently strips them, but
        // `header-setcookie` expects a TypeError for such values.
        if value.contains('\0') || has_bare_cr_lf(&value) {
            return Err(Exception::throw_type(&ctx, "Invalid header value"));
        }
        normalize_header_value_inplace(&ctx, &mut value)?;
        // Value-based forbidden header check (must run after value normalisation).
        if matches!(
            self.guard,
            HeadersGuard::Request | HeadersGuard::RequestNoCors
        ) && is_forbidden_method_override(&key, &value)
        {
            return Ok(());
        }
        if self.guard == HeadersGuard::RequestNoCors {
            let val = value.split(',').next().unwrap_or("").trim();
            if !is_cors_safelisted_request_header(&key, val) {
                return Ok(()); // silently ignore disallowed header
            }
            value = val.into();
        }
        if !is_http_header_value(&value) {
            return Err(Exception::throw_type(&ctx, "Invalid value of key"));
        }

        if key.as_ref() == SET_COOKIE.as_str() {
            self.headers.retain(|(k, _)| k != &key);
            self.headers.push((key, value.into()));
        } else {
            match self.headers.iter_mut().find(|(k, _)| k == &key) {
                Some((_, existing_value)) => *existing_value = value.into(),
                None => {
                    self.headers.push((key, value.into()));
                },
            }
        }
        Ok(())