Please note, this is a STATIC archive of website developer.mozilla.org from 03 Nov 2016, cach3.com does not collect or store any user information, there is no "phishing" involved.

Forbidden header name

我们的志愿者还没有将这篇文章翻译为 中文 (简体)加入我们帮助完成翻译!

A forbidden header name is an HTTP header name that cannot be modified programmatically.

These are forbidden, so the user agent retains full control over them. Names starting with `Sec-` are reserved for creating new headers safe from APIs using Fetch that grant developers control over headers, such as XMLHttpRequest.

Forbidden headers names start with Proxy- or Sec-, or consists of one of these:

  • Accept-Charset
  • Accept-Encoding
  • Access-Control-Request-Headers
  • Access-Control-Request-Method
  • Connection
  • Content-Length
  • Cookie
  • Cookie2
  • Date
  • DNT
  • Expect
  • Host
  • Keep-Alive
  • Origin
  • Proxy-
  • Sec-
  • Referer
  • TE
  • Trailer
  • Transfer-Encoding
  • Upgrade
  • Via

Note: The User-Agent header is no longer forbidden, as per spec — see forbidden header name list (this was implemented in Firefox 43,) so can now be set in a Fetch Headers object, via XHR setRequestHeader(), etc.

文档标签和贡献者

 此页面的贡献者: fscholz, chrisdavidmills, Andrew_Pfeiffer, kscarfone
 最后编辑者: fscholz,