kyy
f464ba2d31
Some checks failed
Node.js CI / build (push) Failing after 2s
Node.js CI / e2e-tests (+(a11y|security|bugs)/**/*cy.js) (push) Failing after 2s
Node.js CI / e2e-tests (features/**/!(o|d|m)*.cy.js) (push) Failing after 2s
Node.js CI / e2e-tests (features/**/+(o|d)*.cy.js) (push) Failing after 2s
Node.js CI / e2e-tests (features/**/m*.cy.js) (push) Failing after 2s
CodeQL / Analyze (javascript) (push) Failing after 2m49s
Security scan for docker image / build (push) Failing after 54s
39 lines
845 B
Markdown
Executable File
39 lines
845 B
Markdown
Executable File
# Limitations
|
|
|
|
### Forbidden header names
|
|
|
|
Some header names cannot be controlled by web applications, due to security
|
|
features built into web browsers.
|
|
|
|
Forbidden headers include:
|
|
|
|
> - Accept-Charset
|
|
> - Accept-Encoding
|
|
> - Access-Control-Request-Headers
|
|
> - Access-Control-Request-Method
|
|
> - Connection
|
|
> - Content-Length
|
|
> - Cookie
|
|
> - Cookie2
|
|
> - Date
|
|
> - DNT
|
|
> - Expect
|
|
> - Host
|
|
> - Keep-Alive
|
|
> - Origin
|
|
> - Proxy-*
|
|
> - Sec-*
|
|
> - Referer
|
|
> - TE
|
|
> - Trailer
|
|
> - Transfer-Encoding
|
|
> - Upgrade
|
|
> - Via
|
|
>
|
|
> _[Forbidden header names (developer.mozilla.org)](https://developer.mozilla.org/en-US/docs/Glossary/Forbidden_header_name)_
|
|
|
|
The biggest impact of this is that OpenAPI 3.0 Cookie parameters cannot be
|
|
controlled when running Swagger UI in a browser.
|
|
|
|
For more context, see [#3956](https://github.com/swagger-api/swagger-ui/issues/3956).
|