kyy
f464ba2d31
Some checks failed
Node.js CI / build (push) Failing after 2s
Node.js CI / e2e-tests (+(a11y|security|bugs)/**/*cy.js) (push) Failing after 2s
Node.js CI / e2e-tests (features/**/!(o|d|m)*.cy.js) (push) Failing after 2s
Node.js CI / e2e-tests (features/**/+(o|d)*.cy.js) (push) Failing after 2s
Node.js CI / e2e-tests (features/**/m*.cy.js) (push) Failing after 2s
CodeQL / Analyze (javascript) (push) Failing after 2m49s
Security scan for docker image / build (push) Failing after 54s
845 B
Executable File
845 B
Executable File
Limitations
Forbidden header names
Some header names cannot be controlled by web applications, due to security features built into web browsers.
Forbidden headers include:
- Accept-Charset
- Accept-Encoding
- Access-Control-Request-Headers
- Access-Control-Request-Method
- Connection
- Content-Length
- Cookie
- Cookie2
- Date
- DNT
- Expect
- Host
- Keep-Alive
- Origin
- Proxy-*
- Sec-*
- Referer
- TE
- Trailer
- Transfer-Encoding
- Upgrade
- Via
The biggest impact of this is that OpenAPI 3.0 Cookie parameters cannot be controlled when running Swagger UI in a browser.
For more context, see #3956.