feat(http) add unsafe-headers feature flag (#1050)

* [http] add unsafe-headers feature flag

* change file

* fmt

.changes/http-unsafe-headers.md

@@ -0,0 +1,5 @@
+---
+"http": patch
+---
+
+Add `unsafe-headers` cargo feature flag to allow using [forbidden headers](https://fetch.spec.whatwg.org/#terminology-headers). 

plugins/http/Cargo.toml

@@ -53,3 +53,4 @@ deflate = [ "reqwest/deflate" ]
 trust-dns = [ "reqwest/trust-dns" ]
 socks = [ "reqwest/socks" ]
 http3 = [ "reqwest/http3" ]
+unsafe-headers = []

plugins/http/src/commands.rs

@@ -195,7 +195,8 @@ pub async fn fetch<R: Runtime>(
                 for (name, value) in &headers {
                     let name = HeaderName::from_bytes(name.as_bytes())?;
                     let value = HeaderValue::from_bytes(value.as_bytes())?;
-                    if !matches!(
+                    #[cfg(not(feature = "unsafe-headers"))]
+                    if matches!(
                         name,
                         // forbidden headers per fetch spec https://fetch.spec.whatwg.org/#terminology-headers
                         header::ACCEPT_CHARSET
@@ -218,8 +219,10 @@ pub async fn fetch<R: Runtime>(
                             | header::UPGRADE
                             | header::VIA
                     ) {
-                        request = request.header(name, value);
+                        continue;
                     }
+
+                    request = request.header(name, value);
                 }
 
                 // POST and PUT requests should always have a 0 length content-length,