add doc for Headers.getSetCookie() by chrisdavidmills · Pull Request #26161 · mdn/content

chrisdavidmills · 2023-04-12T15:44:04Z

Description

The Headers.getSetCookie() method has been added to Chrome 113. This PR adds a reference document for this new method.

This is a pretty straightforward addition. You can find other useful links in my research document.

One question I had — the Set-Cookie header page includes a note:

Warning: Browsers block frontend JavaScript code from accessing the Set-Cookie header, as required by the Fetch spec, which defines Set-Cookie as a forbidden response-header name that must be filtered out from any response exposed to frontend code.

This sounds contradictory to the purpose of getSetCookie() — has this note interpreted the spec correctly, and if so, should I update it to list getSetCookie() as an exception to this rule?

Motivation

Additional details

Related issues and pull requests

Fix #24266

github-actions · 2023-04-12T15:46:16Z

Preview URLs

Flaws (1)

Note! 1 document with no flaws that don't need to be listed. 🎉

URL: /en-US/docs/Web/API/Headers/getSetCookie
Title: Headers: getSetCookie() method
Flaw count: 1

bad_bcd_queries:
- No BCD data for query: api.Headers.getSetCookie

External URLs (1)

URL: /en-US/docs/Web/API/Headers/getSetCookie
Title: Headers: getSetCookie() method

https://fetch.spec.whatwg.org/ (2 times) (Note! This may be a new URL 👀)

(comment last updated: 2023-04-17 17:10:45)

Josh-Cena · 2023-04-12T16:03:24Z

This sounds contradictory to the purpose of getSetCookie() — has this note interpreted the spec correctly, and if so, should I update it to list getSetCookie() as an exception to this rule?

AFAICT, this method is intended for server environments, such as Cloudflare workers and Node.js. Client code cannot create or obtain a response with Set-Cookie, but that's not fundamentally contradictory to this method's presence on an existing response. See: whatwg/fetch#973

ricea · 2023-04-13T08:44:56Z

Because the Set-Cookie header is stripped from responses on the network, the example as it stands is misleading. I haven't been able to come up with a compelling example, but you can do something like:

const headers = new Headers({
    "Set-Cookie": "name=value",
});
headers.getSetCookie();

chrisdavidmills · 2023-04-17T06:07:47Z

This sounds contradictory to the purpose of getSetCookie() — has this note interpreted the spec correctly, and if so, should I update it to list getSetCookie() as an exception to this rule?

AFAICT, this method is intended for server environments, such as Cloudflare workers and Node.js. Client code cannot create or obtain a response with Set-Cookie, but that's not fundamentally contradictory to this method's presence on an existing response. See: whatwg/fetch#973

Thanks @Josh-Cena , that makes total sense.

chrisdavidmills · 2023-04-17T06:26:14Z

Because the Set-Cookie header is stripped from responses on the network, the example as it stands is misleading. I haven't been able to come up with a compelling example, but you can do something like:

Thanks @ricea. I've updated the page now; let me know what you think

ricea

lgtm with nitpick

ricea · 2023-04-17T07:56:16Z

+});
+```
+
+However, something like the following can be used to query `Set-Cookie` values on the server:


This will work in the browser too, so you can remove the words "on the server".

It's only when communicating with the network that the Set-Cookie header is removed. As long as you stay in JavaScript, you can use it (it's just not very useful).

Makes sense. I've updated the wording again but tried something slightly different to get all the points across that you made in the above message.

Josh-Cena · 2023-04-17T16:24:21Z

+});
+```
+
+However, something like the following can be used to query `Set-Cookie` values. This is much more useful on the server, but it would also work on the client.


Another random drive-by: the motivation for the method is to retrieve multiple Set-Cookie values. Would be cool to have an example like that.

Another random drive-by: the motivation for the method is to retrieve multiple Set-Cookie values. Would be cool to have an example like that.

Makes sense; I've updated the second example to show this.

Josh-Cena · 2023-04-17T16:48:44Z

 const headers = new Headers({
-  "Set-Cookie": "name=value",
+  "Set-Cookie": "name1=value1",
+  "Set-Cookie": "name2=value2",
 });

 headers.getSetCookie();


This is against how JS object literals work: later properties always override the former, so the Headers constructor cannot possibly see both properties. You need to set the header later.

const headers = new Headers({ "Set-Cookie": "name1=value1", }); headers.append("Set-Cookie", "name2=value2"); headers.getSetCookie();

(Can't test because my Chrome Canary doesn't seem to have this yet)

Darnit; that was a silly mistake. This is what happens when you try to do things quickly. Fixed now; thanks ;-)

And I tested the code on my Canary just to make sure.

ricea

lgtm, thanks!

chrisdavidmills · 2023-04-18T06:02:29Z

lgtm, thanks!

@ricea super, thanks for the review.

@Elchi3 , I know you merged the BCD for this one. Can you give the method page a quick look and merge? Thanks in advance.

Elchi3

Thanks Chris and everyone! 👍

add doc for Headers.getSetCookie()

1003a9f

chrisdavidmills requested review from a team and Elchi3 and removed request for a team April 12, 2023 15:44

github-actions Bot added the Content:WebAPI Web API docs label Apr 12, 2023

chrisdavidmills added 2 commits April 17, 2023 07:08

Merge branch 'main' into headers-getsetcookie

da3423f

Updates made according to comments from Josh-Cena and ricea

838b3fb

ricea reviewed Apr 17, 2023

View reviewed changes

another wording update

1f97daa

Josh-Cena reviewed Apr 17, 2023

View reviewed changes

Update example to show retrieval of multiple Set-Cookie values

96ba561

Josh-Cena reviewed Apr 17, 2023

View reviewed changes

fix code error

7f20a40

ricea reviewed Apr 18, 2023

View reviewed changes

Elchi3 approved these changes Apr 18, 2023

View reviewed changes

Elchi3 merged commit f334275 into mdn:main Apr 18, 2023

Uh oh!

Conversation

chrisdavidmills commented Apr 12, 2023 • edited by Josh-Cena Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Motivation

Additional details

Related issues and pull requests

Uh oh!

github-actions Bot commented Apr 12, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Josh-Cena commented Apr 12, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ricea commented Apr 13, 2023

Uh oh!

chrisdavidmills commented Apr 17, 2023

Uh oh!

chrisdavidmills commented Apr 17, 2023

Uh oh!

ricea left a comment

Choose a reason for hiding this comment

Uh oh!

ricea Apr 17, 2023

Choose a reason for hiding this comment

Uh oh!

chrisdavidmills Apr 17, 2023

Choose a reason for hiding this comment

Uh oh!

Josh-Cena Apr 17, 2023

Choose a reason for hiding this comment

Uh oh!

chrisdavidmills Apr 17, 2023

Choose a reason for hiding this comment

Uh oh!

Josh-Cena Apr 17, 2023

Choose a reason for hiding this comment

Uh oh!

chrisdavidmills Apr 17, 2023

Choose a reason for hiding this comment

Uh oh!

ricea left a comment

Choose a reason for hiding this comment

Uh oh!

chrisdavidmills commented Apr 18, 2023

Uh oh!

Elchi3 left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

chrisdavidmills commented Apr 12, 2023 •

edited by Josh-Cena

Loading

github-actions Bot commented Apr 12, 2023 •

edited

Loading

Josh-Cena commented Apr 12, 2023 •

edited

Loading