new Response throws RangeError for status 101

[ayonli]

Version

v22.0.0

Platform

Darwin mba.local 23.4.0 Darwin Kernel Version 23.4.0: Fri Mar 15 00:12:41 PDT 2024; root:xnu-10063.101.17~1/RELEASE_ARM64_T8103 arm64

Subsystem

No response

What steps will reproduce the bug?

new Response(null, { status: 101 })

How often does it reproduce? Is there a required condition?

Always.

What is the expected behavior? Why is that the expected behavior?

The code should return a Response instance with status 101, as it's the normal behavior and 101 is a normal HTTP status code.

What do you see instead?

Uncaught RangeError: init["status"] must be in the range of 200 to 599, inclusive.

Additional information

I'm trying to write applications that conform to the modern Web standard which relies on the Web APIs such as Request and Response, which are a trend now, other runtimes such as Deno and Bun all use these APIs, and frameworks such as Hono also use these APIs too. Having the correct behavior of these APIs is an essential goal of Node.js, I think.

[benjamingr]

The WHATWG spec requires us to throw a RangeError

If init["status"] is not in the range 200 to 599, inclusive, then throw a RangeError.

I'll open an issue upstream in whatwg/fetch

[benjamingr]

whatwg/fetch#1759

[benjamingr]

@KhafraDev @nodejs/undici wdyt?

[KhafraDev]

We will add it once it's amended in the spec.

[benjamingr]

@KhafraDev so you think we shouldn't deviate from the spec (like Bun and Deno) in this case?

[KhafraDev]

We've followed what Deno has done in the past (redirect: 'manual' and getting rid of forbidden headers, maybe some other things) and it has always caused issues. The latter one has specifically caused at least two security vulnerabilities and dozens of bugs for us. Node not having a concept of an origin has caused countless issues too (not that we did that to follow another environment, but another example of a deviation from the spec causing issues).

What I'm getting at is in every single scenario where we do not follow the spec verbatim, it causes issues. Not to be rude but I no longer care what other server environments do with fetch.

[benjamingr]

@KhafraDev Thanks, I personally agree (see my comment above). I wanted another perspective.

[mcollina]

IMHO the only deviation from the spec we should be doing is to support fetch() use cases that our users expect to be able to do in Node.js and they are blocked in Browsers. This is (unfortunately) a fuzzy line, and mistakes can be made. One examples are cookies, and there are definitely more.

[benjamingr]

Hey sorry, it looks like we're not going to do this unless the spec changes in order to not violate the spec. We're happy to do this once WHATWG amends the spec.