LibHTTP+LibWeb+RequestServer: Move Fetch's HTTP header infra to LibHTTP

The end goal here is for LibHTTP to be the home of our RFC 9111 (HTTP
caching) implementation. We currently have one implementation in LibWeb
for our in-memory cache and another in RequestServer for our disk cache.

The implementations both largely revolve around interacting with HTTP
headers. But in LibWeb, we are using Fetch's header infra, and in RS we
are using are home-grown header infra from LibHTTP.

So to give these a common denominator, this patch replaces the LibHTTP
implementation with Fetch's infra. Our existing LibHTTP implementation
was not particularly compliant with any spec, so this at least gives us
a standards-based common implementation.

This migration also required moving a handful of other Fetch AOs over
to LibHTTP. (It turns out these AOs were all from the Fetch/Infra/HTTP
folder, so perhaps it makes sense for LibHTTP to be the implementation
of that entire set of facilities.)

Libraries/LibWeb/Fetch/Infrastructure/HTTP/CORS.cpp

@@ -8,15 +8,15 @@
 
 #include <AK/Checked.h>
 #include <LibHTTP/Header.h>
+#include <LibHTTP/HeaderList.h>
 #include <LibTextCodec/Decoder.h>
 #include <LibWeb/Fetch/Infrastructure/HTTP/CORS.h>
-#include <LibWeb/Fetch/Infrastructure/HTTP/Headers.h>
 #include <LibWeb/MimeSniff/MimeType.h>
 
 namespace Web::Fetch::Infrastructure {
 
 // https://fetch.spec.whatwg.org/#cors-safelisted-request-header
-bool is_cors_safelisted_request_header(Header const& header)
+bool is_cors_safelisted_request_header(HTTP::Header const& header)
 {
     auto const& [name, value] = header;
 
@@ -61,7 +61,7 @@ bool is_cors_safelisted_request_header(Header const& header)
     // `range`
     else if (name.equals_ignoring_ascii_case("range"sv)) {
         // 1. Let rangeValue be the result of parsing a single range header value given value and false.
-        auto range_value = parse_single_range_header_value(value, false);
+        auto range_value = HTTP::parse_single_range_header_value(value, false);
 
         // 2. If rangeValue is failure, then return false.
         if (!range_value.has_value())
@@ -93,7 +93,7 @@ bool is_cors_unsafe_request_header_byte(u8 byte)
 }
 
 // https://fetch.spec.whatwg.org/#cors-unsafe-request-header-names
-Vector<ByteString> get_cors_unsafe_header_names(HeaderList const& headers)
+Vector<ByteString> get_cors_unsafe_header_names(HTTP::HeaderList const& headers)
 {
     // 1. Let unsafeNames be a new list.
     Vector<ByteString> unsafe_names;
@@ -124,7 +124,7 @@ Vector<ByteString> get_cors_unsafe_header_names(HeaderList const& headers)
         unsafe_names.extend(move(potentially_unsafe_names));
 
     // 6. Return the result of convert header names to a sorted-lowercase set with unsafeNames.
-    return convert_header_names_to_a_sorted_lowercase_set(unsafe_names.span());
+    return HTTP::convert_header_names_to_a_sorted_lowercase_set(unsafe_names.span());
 }
 
 // https://fetch.spec.whatwg.org/#cors-non-wildcard-request-header-name
@@ -164,7 +164,7 @@ bool is_cors_safelisted_response_header_name(StringView header_name, ReadonlySpa
                "Pragma"sv)
         || any_of(list, [&](auto list_header_name) {
                return header_name.equals_ignoring_ascii_case(list_header_name)
-                   && !is_forbidden_response_header_name(list_header_name);
+                   && !HTTP::is_forbidden_response_header_name(list_header_name);
            });
 }
 
@@ -184,7 +184,7 @@ bool is_no_cors_safelisted_request_header_name(StringView header_name)
 }
 
 // https://fetch.spec.whatwg.org/#no-cors-safelisted-request-header
-bool is_no_cors_safelisted_request_header(Header const& header)
+bool is_no_cors_safelisted_request_header(HTTP::Header const& header)
 {
     // 1. If name is not a no-CORS-safelisted request-header name, then return false.
     if (!is_no_cors_safelisted_request_header_name(header.name))

Libraries/LibWeb/Fetch/Infrastructure/HTTP/CORS.h

@@ -9,17 +9,17 @@
 #include <AK/ByteString.h>
 #include <AK/StringView.h>
 #include <AK/Vector.h>
-#include <LibWeb/Forward.h>
+#include <LibHTTP/Forward.h>
 
 namespace Web::Fetch::Infrastructure {
 
-[[nodiscard]] bool is_cors_safelisted_request_header(Header const&);
+[[nodiscard]] bool is_cors_safelisted_request_header(HTTP::Header const&);
 [[nodiscard]] bool is_cors_unsafe_request_header_byte(u8);
-[[nodiscard]] Vector<ByteString> get_cors_unsafe_header_names(HeaderList const&);
+[[nodiscard]] Vector<ByteString> get_cors_unsafe_header_names(HTTP::HeaderList const&);
 [[nodiscard]] bool is_cors_non_wildcard_request_header_name(StringView);
 [[nodiscard]] bool is_privileged_no_cors_request_header_name(StringView);
 [[nodiscard]] bool is_cors_safelisted_response_header_name(StringView, ReadonlySpan<StringView>);
 [[nodiscard]] bool is_no_cors_safelisted_request_header_name(StringView);
-[[nodiscard]] bool is_no_cors_safelisted_request_header(Header const&);
+[[nodiscard]] bool is_no_cors_safelisted_request_header(HTTP::Header const&);
 
 }

Libraries/LibWeb/Fetch/Infrastructure/HTTP/Headers.cpp

@@ -1,608 +0,0 @@
-/*
- * Copyright (c) 2022-2023, Linus Groh <linusg@serenityos.org>
- * Copyright (c) 2022, Kenneth Myhra <kennethmyhra@serenityos.org>
- * Copyright (c) 2022, Luke Wilde <lukew@serenityos.org>
- *
- * SPDX-License-Identifier: BSD-2-Clause
- */
-
-#include <AK/CharacterTypes.h>
-#include <AK/Checked.h>
-#include <AK/GenericLexer.h>
-#include <AK/QuickSort.h>
-#include <AK/StringUtils.h>
-#include <LibJS/Runtime/VM.h>
-#include <LibRegex/Regex.h>
-#include <LibTextCodec/Decoder.h>
-#include <LibTextCodec/Encoder.h>
-#include <LibWeb/Fetch/Infrastructure/HTTP.h>
-#include <LibWeb/Fetch/Infrastructure/HTTP/Headers.h>
-#include <LibWeb/Fetch/Infrastructure/HTTP/Methods.h>
-#include <LibWeb/Loader/ResourceLoader.h>
-
-namespace Web::Fetch::Infrastructure {
-
-GC_DEFINE_ALLOCATOR(HeaderList);
-
-Header Header::isomorphic_encode(StringView name, StringView value)
-{
-    return {
-        .name = TextCodec::isomorphic_encode(name),
-        .value = TextCodec::isomorphic_encode(value),
-    };
-}
-
-// https://fetch.spec.whatwg.org/#extract-header-values
-Optional<Vector<ByteString>> Header::extract_header_values() const
-{
-    // FIXME: 1. If parsing header’s value, per the ABNF for header’s name, fails, then return failure.
-    // FIXME: 2. Return one or more values resulting from parsing header’s value, per the ABNF for header’s name.
-
-    // For now we only parse some headers that are of the ABNF list form "#something"
-    if (name.is_one_of_ignoring_ascii_case(
-            "Access-Control-Request-Headers"sv,
-            "Access-Control-Expose-Headers"sv,
-            "Access-Control-Allow-Headers"sv,
-            "Access-Control-Allow-Methods"sv)
-        && !value.is_empty()) {
-        Vector<ByteString> trimmed_values;
-
-        value.view().for_each_split_view(',', SplitBehavior::Nothing, [&](auto value) {
-            trimmed_values.append(value.trim(" \t"sv));
-        });
-
-        return trimmed_values;
-    }
-
-    // This always ignores the ABNF rules for now and returns the header value as a single list item.
-    return Vector { value };
-}
-
-GC::Ref<HeaderList> HeaderList::create(JS::VM& vm)
-{
-    return vm.heap().allocate<HeaderList>();
-}
-
-// https://fetch.spec.whatwg.org/#header-list-contains
-bool HeaderList::contains(StringView name) const
-{
-    // A header list list contains a header name name if list contains a header whose name is a byte-case-insensitive
-    // match for name.
-    return any_of(*this, [&](auto const& header) {
-        return header.name.equals_ignoring_ascii_case(name);
-    });
-}
-
-// https://fetch.spec.whatwg.org/#concept-header-list-get
-Optional<ByteString> HeaderList::get(StringView name) const
-{
-    // To get a header name name from a header list list, run these steps:
-
-    // 1. If list does not contain name, then return null.
-    if (!contains(name))
-        return {};
-
-    // 2. Return the values of all headers in list whose name is a byte-case-insensitive match for name, separated from
-    //    each other by 0x2C 0x20, in order.
-    StringBuilder builder;
-    bool first = true;
-
-    for (auto const& header : *this) {
-        if (!header.name.equals_ignoring_ascii_case(name))
-            continue;
-
-        if (!first)
-            builder.append(", "sv);
-
-        builder.append(header.value);
-        first = false;
-    }
-
-    return builder.to_byte_string();
-}
-
-// https://fetch.spec.whatwg.org/#concept-header-list-get-decode-split
-Optional<Vector<String>> HeaderList::get_decode_and_split(StringView name) const
-{
-    // To get, decode, and split a header name name from header list list, run these steps:
-
-    // 1. Let value be the result of getting name from list.
-    auto value = get(name);
-
-    // 2. If value is null, then return null.
-    if (!value.has_value())
-        return {};
-
-    // 3. Return the result of getting, decoding, and splitting value.
-    return get_decode_and_split_header_value(*value);
-}
-
-// https://fetch.spec.whatwg.org/#concept-header-list-append
-void HeaderList::append(Header header)
-{
-    // To append a header (name, value) to a header list list, run these steps:
-
-    // 1. If list contains name, then set name to the first such header’s name.
-    // NOTE: This reuses the casing of the name of the header already in list, if any. If there are multiple matched
-    //       headers their names will all be identical.
-    auto matching_header = first_matching([&](auto const& existing_header) {
-        return existing_header.name.equals_ignoring_ascii_case(header.name);
-    });
-
-    if (matching_header.has_value())
-        header.name = matching_header->name;
-
-    // 2. Append (name, value) to list.
-    Vector::append(move(header));
-}
-
-// https://fetch.spec.whatwg.org/#concept-header-list-delete
-void HeaderList::delete_(StringView name)
-{
-    // To delete a header name name from a header list list, remove all headers whose name is a byte-case-insensitive
-    // match for name from list.
-    remove_all_matching([&](auto const& header) {
-        return header.name.equals_ignoring_ascii_case(name);
-    });
-}
-
-// https://fetch.spec.whatwg.org/#concept-header-list-set
-void HeaderList::set(Header header)
-{
-    // To set a header (name, value) in a header list list, run these steps:
-
-    // 1. If list contains name, then set the value of the first such header to value and remove the others.
-    auto it = find_if([&](auto const& existing_header) {
-        return existing_header.name.equals_ignoring_ascii_case(header.name);
-    });
-
-    if (it != end()) {
-        it->value = move(header.value);
-
-        size_t i = 0;
-        remove_all_matching([&](auto const& existing_header) {
-            if (i++ <= it.index())
-                return false;
-
-            return existing_header.name.equals_ignoring_ascii_case(it->name);
-        });
-    }
-    // 2. Otherwise, append header (name, value) to list.
-    else {
-        append(move(header));
-    }
-}
-
-// https://fetch.spec.whatwg.org/#concept-header-list-combine
-void HeaderList::combine(Header header)
-{
-    // To combine a header (name, value) in a header list list, run these steps:
-
-    // 1. If list contains name, then set the value of the first such header to its value, followed by 0x2C 0x20,
-    //    followed by value.
-    auto matching_header = first_matching([&](auto const& existing_header) {
-        return existing_header.name.equals_ignoring_ascii_case(header.name);
-    });
-
-    if (matching_header.has_value()) {
-        matching_header->value = ByteString::formatted("{}, {}", matching_header->value, header.value);
-    }
-    // 2. Otherwise, append (name, value) to list.
-    else {
-        append(move(header));
-    }
-}
-
-// https://fetch.spec.whatwg.org/#concept-header-list-sort-and-combine
-Vector<Header> HeaderList::sort_and_combine() const
-{
-    // To sort and combine a header list list, run these steps:
-
-    // 1. Let headers be an empty list of headers with the key being the name and value the value.
-    Vector<Header> headers;
-
-    // 2. Let names be the result of convert header names to a sorted-lowercase set with all the names of the headers
-    //    in list.
-    Vector<ByteString> names_list;
-    names_list.ensure_capacity(size());
-
-    for (auto const& header : *this)
-        names_list.unchecked_append(header.name);
-
-    auto names = convert_header_names_to_a_sorted_lowercase_set(names_list);
-
-    // 3. For each name of names:
-    for (auto& name : names) {
-        // 1. If name is `set-cookie`, then:
-        if (name == "set-cookie"sv) {
-            // 1. Let values be a list of all values of headers in list whose name is a byte-case-insensitive match for
-            //    name, in order.
-            // 2. For each value of values:
-            for (auto const& [header_name, value] : *this) {
-                if (header_name.equals_ignoring_ascii_case(name)) {
-                    // 1. Append (name, value) to headers.
-                    headers.append({ name, value });
-                }
-            }
-        }
-        // 2. Otherwise:
-        else {
-            // 1. Let value be the result of getting name from list.
-            auto value = get(name);
-
-            // 2. Assert: value is not null.
-            VERIFY(value.has_value());
-
-            // 3. Append (name, value) to headers.
-            headers.empend(move(name), value.release_value());
-        }
-    }
-
-    // 4. Return headers.
-    return headers;
-}
-
-// https://fetch.spec.whatwg.org/#extract-header-list-values
-Variant<Empty, Vector<ByteString>, HeaderList::ExtractHeaderParseFailure> HeaderList::extract_header_list_values(StringView name) const
-{
-    // 1. If list does not contain name, then return null.
-    if (!contains(name))
-        return {};
-
-    // FIXME: 2. If the ABNF for name allows a single header and list contains more than one, then return failure.
-    // NOTE: If different error handling is needed, extract the desired header first.
-
-    // 3. Let values be an empty list.
-    Vector<ByteString> values;
-
-    // 4. For each header header list contains whose name is name:
-    for (auto const& header : *this) {
-        if (!header.name.equals_ignoring_ascii_case(name))
-            continue;
-
-        // 1. Let extract be the result of extracting header values from header.
-        auto extract = header.extract_header_values();
-
-        // 2. If extract is failure, then return failure.
-        if (!extract.has_value())
-            return ExtractHeaderParseFailure {};
-
-        // 3. Append each value in extract, in order, to values.
-        values.extend(extract.release_value());
-    }
-
-    // 5. Return values.
-    return values;
-}
-
-// https://fetch.spec.whatwg.org/#header-list-extract-a-length
-Variant<Empty, u64, HeaderList::ExtractLengthFailure> HeaderList::extract_length() const
-{
-    // 1. Let values be the result of getting, decoding, and splitting `Content-Length` from headers.
-    auto values = get_decode_and_split("Content-Length"sv);
-
-    // 2. If values is null, then return null.
-    if (!values.has_value())
-        return {};
-
-    // 3. Let candidateValue be null.
-    Optional<String> candidate_value;
-
-    // 4. For each value of values:
-    for (auto const& value : *values) {
-        // 1. If candidateValue is null, then set candidateValue to value.
-        if (!candidate_value.has_value()) {
-            candidate_value = value;
-        }
-        // 2. Otherwise, if value is not candidateValue, return failure.
-        else if (candidate_value.value() != value) {
-            return ExtractLengthFailure {};
-        }
-    }
-
-    // 5. If candidateValue is the empty string or has a code point that is not an ASCII digit, then return null.
-    // 6. Return candidateValue, interpreted as decimal number.
-    // FIXME: This will return an empty Optional if it cannot fit into a u64, is this correct?
-    auto result = candidate_value->to_number<u64>(TrimWhitespace::No);
-    if (!result.has_value())
-        return {};
-
-    return *result;
-}
-
-// Non-standard
-Vector<ByteString> HeaderList::unique_names() const
-{
-    Vector<ByteString> header_names_set;
-    HashTable<StringView, CaseInsensitiveStringTraits> header_names_seen;
-
-    for (auto const& header : *this) {
-        if (header_names_seen.contains(header.name))
-            continue;
-
-        header_names_set.append(header.name);
-        header_names_seen.set(header.name);
-    }
-
-    return header_names_set;
-}
-
-// https://fetch.spec.whatwg.org/#header-name
-bool is_header_name(StringView header_name)
-{
-    // A header name is a byte sequence that matches the field-name token production.
-    Regex<ECMA262Parser> regex { R"~~~(^[A-Za-z0-9!#$%&'*+\-.^_`|~]+$)~~~" };
-    return regex.has_match(header_name);
-}
-
-// https://fetch.spec.whatwg.org/#header-value
-bool is_header_value(StringView header_value)
-{
-    // A header value is a byte sequence that matches the following conditions:
-    // - Has no leading or trailing HTTP tab or space bytes.
-    // - Contains no 0x00 (NUL) or HTTP newline bytes.
-    if (header_value.is_empty())
-        return true;
-
-    auto first_byte = header_value[0];
-    auto last_byte = header_value[header_value.length() - 1];
-
-    if (is_http_tab_or_space(first_byte) || is_http_tab_or_space(last_byte))
-        return false;
-
-    return !any_of(header_value, [](auto byte) {
-        return byte == 0x00 || is_http_newline(byte);
-    });
-}
-
-// https://fetch.spec.whatwg.org/#concept-header-value-normalize
-ByteString normalize_header_value(StringView potential_value)
-{
-    // To normalize a byte sequence potentialValue, remove any leading and trailing HTTP whitespace bytes from
-    // potentialValue.
-    if (potential_value.is_empty())
-        return {};
-    return potential_value.trim(HTTP_WHITESPACE, TrimMode::Both);
-}
-
-// https://fetch.spec.whatwg.org/#forbidden-header-name
-bool is_forbidden_request_header(Header const& header)
-{
-    // A header (name, value) is forbidden request-header if these steps return true:
-    auto const& [name, value] = header;
-
-    // 1. If name is a byte-case-insensitive match for one of:
-    // [...]
-    // then return true.
-    if (name.is_one_of_ignoring_ascii_case(
-            "Accept-Charset"sv,
-            "Accept-Encoding"sv,
-            "Access-Control-Request-Headers"sv,
-            "Access-Control-Request-Method"sv,
-            "Connection"sv,
-            "Content-Length"sv,
-            "Cookie"sv,
-            "Cookie2"sv,
-            "Date"sv,
-            "DNT"sv,
-            "Expect"sv,
-            "Host"sv,
-            "Keep-Alive"sv,
-            "Origin"sv,
-            "Referer"sv,
-            "Set-Cookie"sv,
-            "TE"sv,
-            "Trailer"sv,
-            "Transfer-Encoding"sv,
-            "Upgrade"sv,
-            "Via"sv)) {
-        return true;
-    }
-
-    // 2. If name when byte-lowercased starts with `proxy-` or `sec-`, then return true.
-    if (name.starts_with("proxy-"sv, CaseSensitivity::CaseInsensitive)
-        || name.starts_with("sec-"sv, CaseSensitivity::CaseInsensitive)) {
-        return true;
-    }
-
-    // 3. If name is a byte-case-insensitive match for one of:
-    // - `X-HTTP-Method`
-    // - `X-HTTP-Method-Override`
-    // - `X-Method-Override`
-    // then:
-    if (name.is_one_of_ignoring_ascii_case(
-            "X-HTTP-Method"sv,
-            "X-HTTP-Method-Override"sv,
-            "X-Method-Override"sv)) {
-        // 1. Let parsedValues be the result of getting, decoding, and splitting value.
-        auto parsed_values = get_decode_and_split_header_value(value);
-
-        // 2. For each method of parsedValues: if the isomorphic encoding of method is a forbidden method, then return true.
-        // NB: The values returned from get_decode_and_split_header_value have already been decoded.
-        if (any_of(parsed_values, [](auto const& method) { return is_forbidden_method(method); }))
-            return true;
-    }
-
-    // 4. Return false.
-    return false;
-}
-
-// https://fetch.spec.whatwg.org/#forbidden-response-header-name
-bool is_forbidden_response_header_name(StringView header_name)
-{
-    // A forbidden response-header name is a header name that is a byte-case-insensitive match for one of:
-    // - `Set-Cookie`
-    // - `Set-Cookie2`
-    return header_name.is_one_of_ignoring_ascii_case(
-        "Set-Cookie"sv,
-        "Set-Cookie2"sv);
-}
-
-// https://fetch.spec.whatwg.org/#header-value-get-decode-and-split
-Vector<String> get_decode_and_split_header_value(StringView value)
-{
-    // To get, decode, and split a header value value, run these steps:
-
-    // 1. Let input be the result of isomorphic decoding value.
-    auto input = TextCodec::isomorphic_decode(value);
-
-    // 2. Let position be a position variable for input, initially pointing at the start of input.
-    GenericLexer lexer { input };
-
-    // 3. Let values be a list of strings, initially « ».
-    Vector<String> values;
-
-    // 4. Let temporaryValue be the empty string.
-    StringBuilder temporary_value_builder;
-
-    // 5. While true:
-    while (true) {
-        // 1. Append the result of collecting a sequence of code points that are not U+0022 (") or U+002C (,) from
-        //    input, given position, to temporaryValue.
-        // NOTE: The result might be the empty string.
-        temporary_value_builder.append(lexer.consume_until(is_any_of("\","sv)));
-
-        // 2. If position is not past the end of input and the code point at position within input is U+0022 ("):
-        if (!lexer.is_eof() && lexer.peek() == '"') {
-            // 1. Append the result of collecting an HTTP quoted string from input, given position, to temporaryValue.
-            temporary_value_builder.append(collect_an_http_quoted_string(lexer));
-
-            // 2. If position is not past the end of input, then continue.
-            if (!lexer.is_eof())
-                continue;
-        }
-
-        // 3. Remove all HTTP tab or space from the start and end of temporaryValue.
-        auto temporary_value = MUST(String::from_utf8(temporary_value_builder.string_view().trim(HTTP_TAB_OR_SPACE, TrimMode::Both)));
-
-        // 4. Append temporaryValue to values.
-        values.append(move(temporary_value));
-
-        // 5. Set temporaryValue to the empty string.
-        temporary_value_builder.clear();
-
-        // 6. If position is past the end of input, then return values.
-        if (lexer.is_eof())
-            return values;
-
-        // 7. Assert: the code point at position within input is U+002C (,).
-        VERIFY(lexer.peek() == ',');
-
-        // 8. Advance position by 1.
-        lexer.ignore(1);
-    }
-}
-
-// https://fetch.spec.whatwg.org/#convert-header-names-to-a-sorted-lowercase-set
-Vector<ByteString> convert_header_names_to_a_sorted_lowercase_set(ReadonlySpan<ByteString> header_names)
-{
-    // To convert header names to a sorted-lowercase set, given a list of names headerNames, run these steps:
-
-    // 1. Let headerNamesSet be a new ordered set.
-    HashTable<StringView, CaseInsensitiveStringTraits> header_names_seen;
-    Vector<ByteString> header_names_set;
-
-    // 2. For each name of headerNames, append the result of byte-lowercasing name to headerNamesSet.
-    for (auto const& name : header_names) {
-        if (header_names_seen.contains(name))
-            continue;
-
-        header_names_seen.set(name);
-        header_names_set.append(name.to_lowercase());
-    }
-
-    // 3. Return the result of sorting headerNamesSet in ascending order with byte less than.
-    quick_sort(header_names_set);
-    return header_names_set;
-}
-
-// https://fetch.spec.whatwg.org/#build-a-content-range
-ByteString build_content_range(u64 range_start, u64 range_end, u64 full_length)
-{
-    // 1. Let contentRange be `bytes `.
-    // 2. Append rangeStart, serialized and isomorphic encoded, to contentRange.
-    // 3. Append 0x2D (-) to contentRange.
-    // 4. Append rangeEnd, serialized and isomorphic encoded to contentRange.
-    // 5. Append 0x2F (/) to contentRange.
-    // 6. Append fullLength, serialized and isomorphic encoded to contentRange.
-    // 7. Return contentRange.
-    return ByteString::formatted("bytes {}-{}/{}", range_start, range_end, full_length);
-}
-
-// https://fetch.spec.whatwg.org/#simple-range-header-value
-Optional<RangeHeaderValue> parse_single_range_header_value(StringView const value, bool const allow_whitespace)
-{
-    // 1. Let data be the isomorphic decoding of value.
-    auto const data = TextCodec::isomorphic_decode(value);
-
-    // 2. If data does not start with "bytes", then return failure.
-    if (!data.starts_with_bytes("bytes"sv))
-        return {};
-
-    // 3. Let position be a position variable for data, initially pointing at the 5th code point of data.
-    GenericLexer lexer { data };
-    lexer.ignore(5);
-
-    // 4. If allowWhitespace is true, collect a sequence of code points that are HTTP tab or space, from data given position.
-    if (allow_whitespace)
-        lexer.consume_while(is_http_tab_or_space);
-
-    // 5. If the code point at position within data is not U+003D (=), then return failure.
-    // 6. Advance position by 1.
-    if (!lexer.consume_specific('='))
-        return {};
-
-    // 7. If allowWhitespace is true, collect a sequence of code points that are HTTP tab or space, from data given position.
-    if (allow_whitespace)
-        lexer.consume_while(is_http_tab_or_space);
-
-    // 8. Let rangeStart be the result of collecting a sequence of code points that are ASCII digits, from data given position.
-    auto range_start = lexer.consume_while(is_ascii_digit);
-
-    // 9. Let rangeStartValue be rangeStart, interpreted as decimal number, if rangeStart is not the empty string; otherwise null.
-    auto range_start_value = range_start.to_number<u64>();
-
-    // 10. If allowWhitespace is true, collect a sequence of code points that are HTTP tab or space, from data given position.
-    if (allow_whitespace)
-        lexer.consume_while(is_http_tab_or_space);
-
-    // 11. If the code point at position within data is not U+002D (-), then return failure.
-    // 12. Advance position by 1.
-    if (!lexer.consume_specific('-'))
-        return {};
-
-    // 13. If allowWhitespace is true, collect a sequence of code points that are HTTP tab or space, from data given position.
-    if (allow_whitespace)
-        lexer.consume_while(is_http_tab_or_space);
-
-    // 14. Let rangeEnd be the result of collecting a sequence of code points that are ASCII digits, from data given position.
-    auto range_end = lexer.consume_while(is_ascii_digit);
-
-    // 15. Let rangeEndValue be rangeEnd, interpreted as decimal number, if rangeEnd is not the empty string; otherwise null.
-    auto range_end_value = range_end.to_number<u64>();
-
-    // 16. If position is not past the end of data, then return failure.
-    if (!lexer.is_eof())
-        return {};
-
-    // 17. If rangeEndValue and rangeStartValue are null, then return failure.
-    if (!range_end_value.has_value() && !range_start_value.has_value())
-        return {};
-
-    // 18. If rangeStartValue and rangeEndValue are numbers, and rangeStartValue is greater than rangeEndValue, then return failure.
-    if (range_start_value.has_value() && range_end_value.has_value() && *range_start_value > *range_end_value)
-        return {};
-
-    // 19. Return (rangeStartValue, rangeEndValue).
-    return RangeHeaderValue { move(range_start_value), move(range_end_value) };
-}
-
-// https://fetch.spec.whatwg.org/#default-user-agent-value
-ByteString const& default_user_agent_value()
-{
-    // A default `User-Agent` value is an implementation-defined header value for the `User-Agent` header.
-    static auto user_agent = ResourceLoader::the().user_agent().to_byte_string();
-    return user_agent;
-}
-
-}

Libraries/LibWeb/Fetch/Infrastructure/HTTP/Headers.h

@@ -1,86 +0,0 @@
-/*
- * Copyright (c) 2022-2023, Linus Groh <linusg@serenityos.org>
- *
- * SPDX-License-Identifier: BSD-2-Clause
- */
-
-#pragma once
-
-#include <AK/ByteString.h>
-#include <AK/Optional.h>
-#include <AK/String.h>
-#include <AK/Vector.h>
-#include <LibGC/Heap.h>
-#include <LibGC/Ptr.h>
-#include <LibJS/Forward.h>
-#include <LibJS/Heap/Cell.h>
-#include <LibWeb/Export.h>
-
-namespace Web::Fetch::Infrastructure {
-
-// https://fetch.spec.whatwg.org/#concept-header
-// A header is a tuple that consists of a name (a header name) and value (a header value).
-struct WEB_API Header {
-    [[nodiscard]] static Header isomorphic_encode(StringView, StringView);
-
-    Optional<Vector<ByteString>> extract_header_values() const;
-
-    ByteString name;
-    ByteString value;
-};
-
-// https://fetch.spec.whatwg.org/#concept-header-list
-// A header list is a list of zero or more headers. It is initially the empty list.
-class WEB_API HeaderList final
-    : public JS::Cell
-    , public Vector<Header> {
-    GC_CELL(HeaderList, JS::Cell);
-    GC_DECLARE_ALLOCATOR(HeaderList);
-
-public:
-    [[nodiscard]] static GC::Ref<HeaderList> create(JS::VM&);
-
-    using Vector::begin;
-    using Vector::clear;
-    using Vector::end;
-    using Vector::is_empty;
-
-    [[nodiscard]] bool contains(StringView) const;
-    [[nodiscard]] Optional<ByteString> get(StringView) const;
-    [[nodiscard]] Optional<Vector<String>> get_decode_and_split(StringView) const;
-    void append(Header);
-    void delete_(StringView name);
-    void set(Header);
-    void combine(Header);
-    [[nodiscard]] Vector<Header> sort_and_combine() const;
-
-    struct ExtractHeaderParseFailure { };
-    [[nodiscard]] Variant<Empty, Vector<ByteString>, ExtractHeaderParseFailure> extract_header_list_values(StringView) const;
-
-    struct ExtractLengthFailure { };
-    [[nodiscard]] Variant<Empty, u64, ExtractLengthFailure> extract_length() const;
-
-    [[nodiscard]] Vector<ByteString> unique_names() const;
-};
-
-struct RangeHeaderValue {
-    Optional<u64> start;
-    Optional<u64> end;
-};
-
-[[nodiscard]] bool is_header_name(StringView);
-[[nodiscard]] bool is_header_value(StringView);
-[[nodiscard]] ByteString normalize_header_value(StringView);
-
-[[nodiscard]] bool is_forbidden_request_header(Header const&);
-[[nodiscard]] bool is_forbidden_response_header_name(StringView);
-
-[[nodiscard]] Vector<String> get_decode_and_split_header_value(StringView);
-[[nodiscard]] Vector<ByteString> convert_header_names_to_a_sorted_lowercase_set(ReadonlySpan<ByteString>);
-
-[[nodiscard]] WEB_API ByteString build_content_range(u64 range_start, u64 range_end, u64 full_length);
-[[nodiscard]] WEB_API Optional<RangeHeaderValue> parse_single_range_header_value(StringView, bool);
-
-[[nodiscard]] WEB_API ByteString const& default_user_agent_value();
-
-}

Libraries/LibWeb/Fetch/Infrastructure/HTTP/MIME.cpp

@@ -6,14 +6,14 @@
  * SPDX-License-Identifier: BSD-2-Clause
  */
 
+#include <LibHTTP/HeaderList.h>
 #include <LibTextCodec/Decoder.h>
-#include <LibWeb/Fetch/Infrastructure/HTTP/Headers.h>
 #include <LibWeb/Fetch/Infrastructure/HTTP/MIME.h>
 
 namespace Web::Fetch::Infrastructure {
 
 // https://fetch.spec.whatwg.org/#concept-header-extract-mime-type
-Optional<MimeSniff::MimeType> extract_mime_type(HeaderList const& headers)
+Optional<MimeSniff::MimeType> extract_mime_type(HTTP::HeaderList const& headers)
 {
     // 1. Let charset be null.
     Optional<String> charset;

Libraries/LibWeb/Fetch/Infrastructure/HTTP/MIME.h

@@ -7,12 +7,12 @@
 #pragma once
 
 #include <AK/Optional.h>
-#include <LibWeb/Forward.h>
+#include <LibHTTP/Forward.h>
 #include <LibWeb/MimeSniff/MimeType.h>
 
 namespace Web::Fetch::Infrastructure {
 
-Optional<MimeSniff::MimeType> extract_mime_type(HeaderList const&);
+Optional<MimeSniff::MimeType> extract_mime_type(HTTP::HeaderList const&);
 StringView legacy_extract_an_encoding(Optional<MimeSniff::MimeType> const& mime_type, StringView fallback_encoding);
 
 }

Libraries/LibWeb/Fetch/Infrastructure/HTTP/Methods.cpp

@@ -1,50 +0,0 @@
-/*
- * Copyright (c) 2022, Linus Groh <linusg@serenityos.org>
- * Copyright (c) 2022, Kenneth Myhra <kennethmyhra@serenityos.org>
- *
- * SPDX-License-Identifier: BSD-2-Clause
- */
-
-#include <LibRegex/Regex.h>
-#include <LibWeb/Fetch/Infrastructure/HTTP/Methods.h>
-
-namespace Web::Fetch::Infrastructure {
-
-// https://fetch.spec.whatwg.org/#concept-method
-bool is_method(StringView method)
-{
-    // A method is a byte sequence that matches the method token production.
-    Regex<ECMA262Parser> regex { R"~~~(^[A-Za-z0-9!#$%&'*+\-.^_`|~]+$)~~~" };
-    return regex.has_match(method);
-}
-
-// https://fetch.spec.whatwg.org/#cors-safelisted-method
-bool is_cors_safelisted_method(StringView method)
-{
-    // A CORS-safelisted method is a method that is `GET`, `HEAD`, or `POST`.
-    return method.is_one_of("GET"sv, "HEAD"sv, "POST"sv);
-}
-
-// https://fetch.spec.whatwg.org/#forbidden-method
-bool is_forbidden_method(StringView method)
-{
-    // A forbidden method is a method that is a byte-case-insensitive match for `CONNECT`, `TRACE`, or `TRACK`.
-    return method.is_one_of_ignoring_ascii_case("CONNECT"sv, "TRACE"sv, "TRACK"sv);
-}
-
-// https://fetch.spec.whatwg.org/#concept-method-normalize
-ByteString normalize_method(StringView method)
-{
-    // To normalize a method, if it is a byte-case-insensitive match for `DELETE`, `GET`, `HEAD`, `OPTIONS`, `POST`,
-    // or `PUT`, byte-uppercase it.
-    static auto NORMALIZED_METHODS = to_array<ByteString>({ "DELETE"sv, "GET"sv, "HEAD"sv, "OPTIONS"sv, "POST"sv, "PUT"sv });
-
-    for (auto const& normalized_method : NORMALIZED_METHODS) {
-        if (normalized_method.equals_ignoring_ascii_case(method))
-            return normalized_method;
-    }
-
-    return method;
-}
-
-}

Libraries/LibWeb/Fetch/Infrastructure/HTTP/Methods.h

@@ -1,20 +0,0 @@
-/*
- * Copyright (c) 2022, Linus Groh <linusg@serenityos.org>
- *
- * SPDX-License-Identifier: BSD-2-Clause
- */
-
-#pragma once
-
-#include <AK/ByteString.h>
-#include <AK/StringView.h>
-#include <LibWeb/Export.h>
-
-namespace Web::Fetch::Infrastructure {
-
-[[nodiscard]] bool is_method(StringView);
-[[nodiscard]] WEB_API bool is_cors_safelisted_method(StringView);
-[[nodiscard]] bool is_forbidden_method(StringView);
-[[nodiscard]] ByteString normalize_method(StringView);
-
-}

Libraries/LibWeb/Fetch/Infrastructure/HTTP/Requests.cpp

@@ -20,15 +20,19 @@ namespace Web::Fetch::Infrastructure {
 
 GC_DEFINE_ALLOCATOR(Request);
 
-Request::Request(GC::Ref<HeaderList> header_list)
-    : m_header_list(header_list)
+GC::Ref<Request> Request::create(JS::VM& vm)
+{
+    return vm.heap().allocate<Request>(HTTP::HeaderList::create());
+}
+
+Request::Request(NonnullRefPtr<HTTP::HeaderList> header_list)
+    : m_header_list(move(header_list))
 {
 }
 
 void Request::visit_edges(JS::Cell::Visitor& visitor)
 {
     Base::visit_edges(visitor);
-    visitor.visit(m_header_list);
     visitor.visit(m_client);
     m_body.visit(
         [&](GC::Ref<Body>& body) { visitor.visit(body); },
@@ -44,11 +48,6 @@ void Request::visit_edges(JS::Cell::Visitor& visitor)
         [](auto const&) {});
 }
 
-GC::Ref<Request> Request::create(JS::VM& vm)
-{
-    return vm.heap().allocate<Request>(HeaderList::create(vm));
-}
-
 // https://fetch.spec.whatwg.org/#concept-request-url
 URL::URL& Request::url()
 {

Libraries/LibWeb/Fetch/Infrastructure/HTTP/Requests.h

@@ -16,6 +16,7 @@
 #include <AK/Variant.h>
 #include <AK/Vector.h>
 #include <LibGC/Ptr.h>
+#include <LibHTTP/HeaderList.h>
 #include <LibJS/Forward.h>
 #include <LibJS/Heap/Cell.h>
 #include <LibURL/Origin.h>
@@ -23,7 +24,6 @@
 #include <LibWeb/Export.h>
 #include <LibWeb/Fetch/Infrastructure/HTTP.h>
 #include <LibWeb/Fetch/Infrastructure/HTTP/Bodies.h>
-#include <LibWeb/Fetch/Infrastructure/HTTP/Headers.h>
 
 namespace Web::Fetch::Infrastructure {
 
@@ -178,8 +178,8 @@ public:
     [[nodiscard]] bool local_urls_only() const { return m_local_urls_only; }
     void set_local_urls_only(bool local_urls_only) { m_local_urls_only = local_urls_only; }
 
-    [[nodiscard]] GC::Ref<HeaderList> header_list() const { return m_header_list; }
-    void set_header_list(GC::Ref<HeaderList> header_list) { m_header_list = header_list; }
+    NonnullRefPtr<HTTP::HeaderList> const& header_list() const { return m_header_list; }
+    void set_header_list(NonnullRefPtr<HTTP::HeaderList> header_list) { m_header_list = move(header_list); }
 
     [[nodiscard]] bool unsafe_request() const { return m_unsafe_request; }
     void set_unsafe_request(bool unsafe_request) { m_unsafe_request = unsafe_request; }
@@ -330,7 +330,7 @@ public:
     }
 
 private:
-    explicit Request(GC::Ref<HeaderList>);
+    explicit Request(NonnullRefPtr<HTTP::HeaderList>);
 
     virtual void visit_edges(JS::Cell::Visitor&) override;
 
@@ -344,7 +344,7 @@ private:
 
     // https://fetch.spec.whatwg.org/#concept-request-header-list
     // A request has an associated header list (a header list). Unless stated otherwise it is empty.
-    GC::Ref<HeaderList> m_header_list;
+    NonnullRefPtr<HTTP::HeaderList> m_header_list;
 
     // https://fetch.spec.whatwg.org/#unsafe-request-flag
     // A request has an associated unsafe-request flag. Unless stated otherwise it is unset.

Libraries/LibWeb/Fetch/Infrastructure/HTTP/Responses.cpp

@@ -15,6 +15,7 @@
 #include <LibWeb/Fetch/Infrastructure/HTTP/Bodies.h>
 #include <LibWeb/Fetch/Infrastructure/HTTP/CORS.h>
 #include <LibWeb/Fetch/Infrastructure/HTTP/Responses.h>
+#include <LibWeb/MimeSniff/MimeType.h>
 
 namespace Web::Fetch::Infrastructure {
 
@@ -24,8 +25,13 @@ GC_DEFINE_ALLOCATOR(CORSFilteredResponse);
 GC_DEFINE_ALLOCATOR(OpaqueFilteredResponse);
 GC_DEFINE_ALLOCATOR(OpaqueRedirectFilteredResponse);
 
-Response::Response(GC::Ref<HeaderList> header_list)
-    : m_header_list(header_list)
+GC::Ref<Response> Response::create(JS::VM& vm)
+{
+    return vm.heap().allocate<Response>(HTTP::HeaderList::create());
+}
+
+Response::Response(NonnullRefPtr<HTTP::HeaderList> header_list)
+    : m_header_list(move(header_list))
     , m_response_time(MonotonicTime::now())
 {
 }
@@ -33,15 +39,9 @@ Response::Response(GC::Ref<HeaderList> header_list)
 void Response::visit_edges(JS::Cell::Visitor& visitor)
 {
     Base::visit_edges(visitor);
-    visitor.visit(m_header_list);
     visitor.visit(m_body);
 }
 
-GC::Ref<Response> Response::create(JS::VM& vm)
-{
-    return vm.heap().allocate<Response>(HeaderList::create(vm));
-}
-
 // https://fetch.spec.whatwg.org/#ref-for-concept-network-error%E2%91%A3
 // A network error is a response whose status is always 0, status message is always
 // the empty byte sequence, header list is always empty, and body is always null.
@@ -341,8 +341,8 @@ u64 Response::stale_while_revalidate_lifetime() const
 
 // Non-standard
 
-FilteredResponse::FilteredResponse(GC::Ref<Response> internal_response, GC::Ref<HeaderList> header_list)
-    : Response(header_list)
+FilteredResponse::FilteredResponse(GC::Ref<Response> internal_response, NonnullRefPtr<HTTP::HeaderList> header_list)
+    : Response(move(header_list))
     , m_internal_response(internal_response)
 {
 }
@@ -361,27 +361,22 @@ GC::Ref<BasicFilteredResponse> BasicFilteredResponse::create(JS::VM& vm, GC::Ref
 {
     // A basic filtered response is a filtered response whose type is "basic" and header list excludes
     // any headers in internal response’s header list whose name is a forbidden response-header name.
-    auto header_list = HeaderList::create(vm);
+    auto header_list = HTTP::HeaderList::create();
+
     for (auto const& header : *internal_response->header_list()) {
-        if (!is_forbidden_response_header_name(header.name))
+        if (!HTTP::is_forbidden_response_header_name(header.name))
             header_list->append(header);
     }
 
-    return vm.heap().allocate<BasicFilteredResponse>(internal_response, header_list);
+    return vm.heap().allocate<BasicFilteredResponse>(internal_response, move(header_list));
 }
 
-BasicFilteredResponse::BasicFilteredResponse(GC::Ref<Response> internal_response, GC::Ref<HeaderList> header_list)
+BasicFilteredResponse::BasicFilteredResponse(GC::Ref<Response> internal_response, NonnullRefPtr<HTTP::HeaderList> header_list)
     : FilteredResponse(internal_response, header_list)
-    , m_header_list(header_list)
+    , m_header_list(move(header_list))
 {
 }
 
-void BasicFilteredResponse::visit_edges(JS::Cell::Visitor& visitor)
-{
-    Base::visit_edges(visitor);
-    visitor.visit(m_header_list);
-}
-
 GC::Ref<CORSFilteredResponse> CORSFilteredResponse::create(JS::VM& vm, GC::Ref<Response> internal_response)
 {
     // A CORS filtered response is a filtered response whose type is "cors" and header list excludes
@@ -393,7 +388,7 @@ GC::Ref<CORSFilteredResponse> CORSFilteredResponse::create(JS::VM& vm, GC::Ref<R
     for (auto const& header_name : internal_response->cors_exposed_header_name_list())
         cors_exposed_header_name_list.unchecked_append(header_name);
 
-    auto header_list = HeaderList::create(vm);
+    auto header_list = HTTP::HeaderList::create();
     for (auto const& header : *internal_response->header_list()) {
         if (is_cors_safelisted_response_header_name(header.name, cors_exposed_header_name_list))
             header_list->append(header);
@@ -402,54 +397,36 @@ GC::Ref<CORSFilteredResponse> CORSFilteredResponse::create(JS::VM& vm, GC::Ref<R
     return vm.heap().allocate<CORSFilteredResponse>(internal_response, header_list);
 }
 
-CORSFilteredResponse::CORSFilteredResponse(GC::Ref<Response> internal_response, GC::Ref<HeaderList> header_list)
+CORSFilteredResponse::CORSFilteredResponse(GC::Ref<Response> internal_response, NonnullRefPtr<HTTP::HeaderList> header_list)
     : FilteredResponse(internal_response, header_list)
-    , m_header_list(header_list)
+    , m_header_list(move(header_list))
 {
 }
 
-void CORSFilteredResponse::visit_edges(JS::Cell::Visitor& visitor)
-{
-    Base::visit_edges(visitor);
-    visitor.visit(m_header_list);
-}
-
 GC::Ref<OpaqueFilteredResponse> OpaqueFilteredResponse::create(JS::VM& vm, GC::Ref<Response> internal_response)
 {
     // An opaque filtered response is a filtered response whose type is "opaque", URL list is the empty list,
     // status is 0, status message is the empty byte sequence, header list is empty, and body is null.
-    return vm.heap().allocate<OpaqueFilteredResponse>(internal_response, HeaderList::create(vm));
+    return vm.heap().allocate<OpaqueFilteredResponse>(internal_response, HTTP::HeaderList::create());
 }
 
-OpaqueFilteredResponse::OpaqueFilteredResponse(GC::Ref<Response> internal_response, GC::Ref<HeaderList> header_list)
+OpaqueFilteredResponse::OpaqueFilteredResponse(GC::Ref<Response> internal_response, NonnullRefPtr<HTTP::HeaderList> header_list)
     : FilteredResponse(internal_response, header_list)
-    , m_header_list(header_list)
+    , m_header_list(move(header_list))
 {
 }
 
-void OpaqueFilteredResponse::visit_edges(JS::Cell::Visitor& visitor)
-{
-    Base::visit_edges(visitor);
-    visitor.visit(m_header_list);
-}
-
 GC::Ref<OpaqueRedirectFilteredResponse> OpaqueRedirectFilteredResponse::create(JS::VM& vm, GC::Ref<Response> internal_response)
 {
     // An opaque-redirect filtered response is a filtered response whose type is "opaqueredirect",
     // status is 0, status message is the empty byte sequence, header list is empty, and body is null.
-    return vm.heap().allocate<OpaqueRedirectFilteredResponse>(internal_response, HeaderList::create(vm));
+    return vm.heap().allocate<OpaqueRedirectFilteredResponse>(internal_response, HTTP::HeaderList::create());
 }
 
-OpaqueRedirectFilteredResponse::OpaqueRedirectFilteredResponse(GC::Ref<Response> internal_response, GC::Ref<HeaderList> header_list)
+OpaqueRedirectFilteredResponse::OpaqueRedirectFilteredResponse(GC::Ref<Response> internal_response, NonnullRefPtr<HTTP::HeaderList> header_list)
     : FilteredResponse(internal_response, header_list)
-    , m_header_list(header_list)
+    , m_header_list(move(header_list))
 {
 }
 
-void OpaqueRedirectFilteredResponse::visit_edges(JS::Cell::Visitor& visitor)
-{
-    Base::visit_edges(visitor);
-    visitor.visit(m_header_list);
-}
-
 }

Libraries/LibWeb/Fetch/Infrastructure/HTTP/Responses.h

@@ -13,13 +13,13 @@
 #include <AK/Time.h>
 #include <AK/Vector.h>
 #include <LibGC/Ptr.h>
+#include <LibHTTP/HeaderList.h>
 #include <LibJS/Forward.h>
 #include <LibJS/Heap/Cell.h>
 #include <LibURL/URL.h>
 #include <LibWeb/Export.h>
 #include <LibWeb/Fetch/Infrastructure/HTTP.h>
 #include <LibWeb/Fetch/Infrastructure/HTTP/Bodies.h>
-#include <LibWeb/Fetch/Infrastructure/HTTP/Headers.h>
 #include <LibWeb/Fetch/Infrastructure/HTTP/Statuses.h>
 
 namespace Web::Fetch::Infrastructure {
@@ -81,8 +81,8 @@ public:
     [[nodiscard]] virtual ByteString const& status_message() const { return m_status_message; }
     virtual void set_status_message(ByteString status_message) { m_status_message = move(status_message); }
 
-    [[nodiscard]] virtual GC::Ref<HeaderList> header_list() const { return m_header_list; }
-    virtual void set_header_list(GC::Ref<HeaderList> header_list) { m_header_list = header_list; }
+    virtual NonnullRefPtr<HTTP::HeaderList> const& header_list() const { return m_header_list; }
+    virtual void set_header_list(NonnullRefPtr<HTTP::HeaderList> header_list) { m_header_list = move(header_list); }
 
     [[nodiscard]] virtual GC::Ptr<Body> body() const { return m_body; }
     virtual void set_body(GC::Ptr<Body> body) { m_body = body; }
@@ -130,7 +130,7 @@ public:
     MonotonicTime response_time() const { return m_response_time; }
 
 protected:
-    explicit Response(GC::Ref<HeaderList>);
+    explicit Response(NonnullRefPtr<HTTP::HeaderList>);
 
     virtual void visit_edges(JS::Cell::Visitor&) override;
 
@@ -157,7 +157,7 @@ private:
 
     // https://fetch.spec.whatwg.org/#concept-response-header-list
     // A response has an associated header list (a header list). Unless stated otherwise it is empty.
-    GC::Ref<HeaderList> m_header_list;
+    NonnullRefPtr<HTTP::HeaderList> m_header_list;
 
     // https://fetch.spec.whatwg.org/#concept-response-body
     // A response has an associated body (null or a body). Unless stated otherwise it is null.
@@ -215,7 +215,7 @@ class FilteredResponse : public Response {
     GC_CELL(FilteredResponse, Response);
 
 public:
-    FilteredResponse(GC::Ref<Response>, GC::Ref<HeaderList>);
+    FilteredResponse(GC::Ref<Response>, NonnullRefPtr<HTTP::HeaderList>);
     virtual ~FilteredResponse() = 0;
 
     [[nodiscard]] virtual Type type() const override { return m_internal_response->type(); }
@@ -233,8 +233,8 @@ public:
     [[nodiscard]] virtual ByteString const& status_message() const override { return m_internal_response->status_message(); }
     virtual void set_status_message(ByteString status_message) override { m_internal_response->set_status_message(move(status_message)); }
 
-    [[nodiscard]] virtual GC::Ref<HeaderList> header_list() const override { return m_internal_response->header_list(); }
-    virtual void set_header_list(GC::Ref<HeaderList> header_list) override { m_internal_response->set_header_list(header_list); }
+    virtual NonnullRefPtr<HTTP::HeaderList> const& header_list() const override { return m_internal_response->header_list(); }
+    virtual void set_header_list(NonnullRefPtr<HTTP::HeaderList> header_list) override { m_internal_response->set_header_list(header_list); }
 
     [[nodiscard]] virtual GC::Ptr<Body> body() const override { return m_internal_response->body(); }
     virtual void set_body(GC::Ptr<Body> body) override { m_internal_response->set_body(body); }
@@ -276,14 +276,12 @@ public:
     [[nodiscard]] static GC::Ref<BasicFilteredResponse> create(JS::VM&, GC::Ref<Response>);
 
     [[nodiscard]] virtual Type type() const override { return Type::Basic; }
-    [[nodiscard]] virtual GC::Ref<HeaderList> header_list() const override { return m_header_list; }
+    virtual NonnullRefPtr<HTTP::HeaderList> const& header_list() const override { return m_header_list; }
 
 private:
-    BasicFilteredResponse(GC::Ref<Response>, GC::Ref<HeaderList>);
+    BasicFilteredResponse(GC::Ref<Response>, NonnullRefPtr<HTTP::HeaderList>);
 
-    virtual void visit_edges(JS::Cell::Visitor&) override;
-
-    GC::Ref<HeaderList> m_header_list;
+    NonnullRefPtr<HTTP::HeaderList> m_header_list;
 };
 
 // https://fetch.spec.whatwg.org/#concept-filtered-response-cors
@@ -295,14 +293,12 @@ public:
     [[nodiscard]] static GC::Ref<CORSFilteredResponse> create(JS::VM&, GC::Ref<Response>);
 
     [[nodiscard]] virtual Type type() const override { return Type::CORS; }
-    [[nodiscard]] virtual GC::Ref<HeaderList> header_list() const override { return m_header_list; }
+    virtual NonnullRefPtr<HTTP::HeaderList> const& header_list() const override { return m_header_list; }
 
 private:
-    CORSFilteredResponse(GC::Ref<Response>, GC::Ref<HeaderList>);
+    CORSFilteredResponse(GC::Ref<Response>, NonnullRefPtr<HTTP::HeaderList>);
 
-    virtual void visit_edges(JS::Cell::Visitor&) override;
-
-    GC::Ref<HeaderList> m_header_list;
+    NonnullRefPtr<HTTP::HeaderList> m_header_list;
 };
 
 // https://fetch.spec.whatwg.org/#concept-filtered-response-opaque
@@ -318,17 +314,15 @@ public:
     [[nodiscard]] virtual Vector<URL::URL>& url_list() override { return m_url_list; }
     [[nodiscard]] virtual Status status() const override { return 0; }
     [[nodiscard]] virtual ByteString const& status_message() const override { return m_method; }
-    [[nodiscard]] virtual GC::Ref<HeaderList> header_list() const override { return m_header_list; }
+    virtual NonnullRefPtr<HTTP::HeaderList> const& header_list() const override { return m_header_list; }
     [[nodiscard]] virtual GC::Ptr<Body> body() const override { return nullptr; }
 
 private:
-    OpaqueFilteredResponse(GC::Ref<Response>, GC::Ref<HeaderList>);
-
-    virtual void visit_edges(JS::Cell::Visitor&) override;
+    OpaqueFilteredResponse(GC::Ref<Response>, NonnullRefPtr<HTTP::HeaderList>);
 
     Vector<URL::URL> m_url_list;
     ByteString const m_method;
-    GC::Ref<HeaderList> m_header_list;
+    NonnullRefPtr<HTTP::HeaderList> m_header_list;
 };
 
 // https://fetch.spec.whatwg.org/#concept-filtered-response-opaque-redirect
@@ -342,16 +336,14 @@ public:
     [[nodiscard]] virtual Type type() const override { return Type::OpaqueRedirect; }
     [[nodiscard]] virtual Status status() const override { return 0; }
     [[nodiscard]] virtual ByteString const& status_message() const override { return m_method; }
-    [[nodiscard]] virtual GC::Ref<HeaderList> header_list() const override { return m_header_list; }
+    virtual NonnullRefPtr<HTTP::HeaderList> const& header_list() const override { return m_header_list; }
     [[nodiscard]] virtual GC::Ptr<Body> body() const override { return nullptr; }
 
 private:
-    OpaqueRedirectFilteredResponse(GC::Ref<Response>, GC::Ref<HeaderList>);
-
-    virtual void visit_edges(JS::Cell::Visitor&) override;
+    OpaqueRedirectFilteredResponse(GC::Ref<Response>, NonnullRefPtr<HTTP::HeaderList>);
 
     ByteString const m_method;
-    GC::Ref<HeaderList> m_header_list;
+    NonnullRefPtr<HTTP::HeaderList> m_header_list;
 };
 
 }