set: Type-validates the forbidden "cookie"/"set-cookie" response headers

[kettanaito]

GitHub

• Originates from Refused to set unsafe header "cookie" #818

Changes

• Setting forbidden cookie headers with the ctx.set utility now produces a TypeScript violation.
• Forbidden cookie headers include (case-insensitive):
  • cookie
  • cookie2
  • set-cookie
  • set-cookie2

We are not including all forbidden header names for now, starting with the cookie ones.

Motivation

We should fail fast in preventing the developer from setting forbidden response cookies. Setting such cookies will raise a runtime exception anyway.

Experience

set({ cookie: 'secret' })

// Argument of type '[{ cookie: string; }]' is not assignable to parameter of type
// '"SafeResponseHeader: the 'cookie' header cannot be set on the response. Please use the 'ctx.cookie()' function instead."'.ts(2345)

Utilizes this technique to have custom type violation messages until microsoft/TypeScript#40468 is merged.

[codesandbox-ci]

This pull request is automatically built and testable in CodeSandbox.

To see build info of the built libraries, click here or the icon next to each commit SHA.

Latest deployment of this branch, based on commit 5ce843f:

Sandbox	Source
MSW React	Configuration

[kettanaito]

The smoke tests are failing due to the old TypeScript version being used in the usage examples.