fix: webidl.brandcheck non strict should throw

lib/fetch/webidl.js

@@ -34,10 +34,14 @@ webidl.errors.invalidArgument = function (context) {
 
 // https://webidl.spec.whatwg.org/#implements
 webidl.brandCheck = function (V, I, opts = undefined) {
-  if (opts?.strict !== false && !(V instanceof I)) {
-    throw new TypeError('Illegal invocation')
+  if (opts?.strict !== false) {
+    if (!(V instanceof I)) {
+      throw new TypeError('Illegal invocation')
+    }
   } else {
-    return V?.[Symbol.toStringTag] === I.prototype[Symbol.toStringTag]
+    if (V?.[Symbol.toStringTag] !== I.prototype[Symbol.toStringTag]) {
+      throw new TypeError('Illegal invocation')
+    }
   }
 }
 

test/cookie/cookies.js

@@ -599,3 +599,37 @@ test('Set-Cookie parser', () => {
   headers = new Headers()
   assert.deepEqual(getSetCookies(headers), [])
 })
+
+test('Cookie setCookie throws if headers is not of type Headers', () => {
+  class Headers {
+    [Symbol.toStringTag] = 'CustomHeaders'
+  }
+  const headers = new Headers()
+  assert.throws(
+    () => {
+      setCookie(headers, {
+        name: 'key',
+        value: 'Cat',
+        httpOnly: true,
+        secure: true,
+        maxAge: 3
+      })
+    },
+    new TypeError('Illegal invocation')
+  )
+})
+
+test('Cookie setCookie does not throw if headers is an instance of a custom Headers class', () => {
+  class Headers {
+    [Symbol.toStringTag] = 'Headers'
+    append () { }
+  }
+  const headers = new Headers()
+  setCookie(headers, {
+    name: 'key',
+    value: 'Cat',
+    httpOnly: true,
+    secure: true,
+    maxAge: 3
+  })
+})