Update forbidden request headers in glossary

[verhovsky]

Description

The spec says Cookie2 and Set-Cookie are forbidden. Looking at the Chrome source code it also checks for Access-Control-Request-Private-Network, which is added to the list in this draft spec.

You can try it out by opening https://example.com/ and doing

await fetch('https://example.com', {
  headers: {
    'access-control-request-private-network': 'aaaaaaaaaaaaaa',
    'cookie2': 'bbbbbbbbbbbbbb',
    'set-cookie': 'ccccccccccccc',
    'Permissions-Policy': 'this one actually gets sent',
  }
});

and looking in the Network tab.

Additional details

Chrome source code: https://source.chromium.org/chromium/chromium/src/+/main:net/http/http_util.cc;l=324-348;drc=c8dc70b538f1bb0862f1be58237d6e945ee81819

Spec: https://fetch.spec.whatwg.org/#forbidden-request-header

[github-actions]

Preview URLs

• /en-US/docs/Glossary/Forbidden_request_header

Flaws (1)

URL: /en-US/docs/Glossary/Forbidden_request_header
Title: Forbidden request header
Flaw count: 1

• macros:
  • Can't resolve /en-US/docs/Web/HTTP/Reference/Methods/TRACK

(comment last updated: 2025-11-07 16:17:38)

[hamishwillee]

What browser is this implemented in? MDN doesn't document things that have no implementation.

[verhovsky]

All 3 of them. I linked the Chrome source code and I also ran the snippet I posted above that sends the 4 mentioned headers on macOS:

Chrome

Safari

Firefox

[hamishwillee]

Thanks

[bsmth]

FYI, some context on removal:

• Delete HTTP headers Cookie2 and Set-Cookie2 #13965

[hamishwillee]

Thanks for that clarification @bsmth - I should have searched the history.

I have reverted this in #41964 because Cookie2 is not part of the web platform. I suspect this will come up again until the spec gets updated to remove the mention of this header.

[hamishwillee]

FWIW We should document this header and add it to BCD mdn/browser-compat-data#25467.

Because we have not done so I think this is good (because there is no way for anyone to work out the support story on this) but when BCD/docs exist this would just be in the main list.