From 9e1b5c9f66e9227ddf701ee3f0805009e01002a7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sa=C3=BAl=20Cabrera?= <saulecabrera@gmail.com>
Date: Fri, 17 Jul 2026 14:22:10 -0400
Subject: [PATCH] http(p3): Add tests for forbidden field names

---
 .../rust/wasm32-wasip3/src/bin/http-fields.rs | 62 +++++++++++++++++++
 1 file changed, 62 insertions(+)

diff --git a/tests/rust/wasm32-wasip3/src/bin/http-fields.rs b/tests/rust/wasm32-wasip3/src/bin/http-fields.rs
index 63089f79b..2adb93dd6 100644
--- a/tests/rust/wasm32-wasip3/src/bin/http-fields.rs
+++ b/tests/rust/wasm32-wasip3/src/bin/http-fields.rs
@@ -330,6 +330,67 @@ fn test_field_name_case_insensitivity() {
     );
 }
 
+fn test_forbidden_field_name_cased(name: &str) {
+    let fields = Fields::new();
+    assert_eq!(
+        fields.set(name, &[b"x".to_vec()]),
+        Err(HeaderError::Forbidden),
+        "set({name:?}) should be forbidden"
+    );
+    assert_eq!(
+        fields.append(name, b"x"),
+        Err(HeaderError::Forbidden),
+        "append({name:?}) should be forbidden"
+    );
+    assert_eq!(
+        Fields::from_list(&[(name.to_string(), b"x".to_vec())]).unwrap_err(),
+        HeaderError::Forbidden,
+        "from_list([{name:?}]) should be forbidden"
+    );
+    assert!(
+        !fields.has(name),
+        "forbidden field {name:?} must not be present"
+    );
+}
+
+fn title_case(name: &str) -> String {
+    name.split('-')
+        .map(|seg| {
+            let mut chars = seg.chars();
+            match chars.next() {
+                Some(first) => first.to_uppercase().collect::<String>() + chars.as_str(),
+                None => String::new(),
+            }
+        })
+        .collect::<Vec<_>>()
+        .join("-")
+}
+
+fn test_forbidden_field_name(name: &str) {
+    // Field names are case insensitive for equality checking purposes.
+    test_forbidden_field_name_cased(name);
+    test_forbidden_field_name_cased(&name.to_uppercase());
+    test_forbidden_field_name_cased(&title_case(name));
+}
+
+// The list of definitely forbidden field names is not in the spec yet.
+// See https://github.com/WebAssembly/WASI/issues/940
+fn test_forbidden_field_names() {
+    for name in [
+        "connection",
+        "keep-alive",
+        "proxy-authenticate",
+        "proxy-authorization",
+        "proxy-connection",
+        "transfer-encoding",
+        "upgrade",
+        "http2-settings",
+        "host",
+    ] {
+        test_forbidden_field_name(name);
+    }
+}
+
 struct Component;
 export!(Component);
 impl Guest for Component {
@@ -341,6 +402,7 @@ impl Guest for Component {
         test_invalid_field_values();
         test_valid_field_values();
         test_field_name_case_insensitivity();
+        test_forbidden_field_names();
         Ok(())
     }
 }