{"record":{"id":"73adb9ca7875d170","repo":"usebruno/bruno","slug":"headerlist-is-read-only-response-headers-cannot-b","errorCode":null,"errorMessage":"HeaderList is read-only (response headers cannot be modified)","messagePattern":"HeaderList is read-only \\(response headers cannot be modified\\)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/bruno-js/src/header-list.js","lineNumber":123,"sourceCode":"        }\n      });\n      this.#req = source;\n    } else {\n      // Static read-only mode — snapshot of response headers\n      const rawHeaders = (source && source.headers) || {};\n      super({\n        keyProperty: 'key',\n        valueProperty: 'value',\n        items: Object.entries(rawHeaders).map(([key, value]) => ({ key, value }))\n      });\n      this.#req = null;\n    }\n    this.#writable = writable;\n  }\n\n  #assertWritable() {\n    if (!this.#writable) {\n      throw new Error('HeaderList is read-only (response headers cannot be modified)');\n    }\n  }\n\n  // ── Case-insensitive key helpers ──────────────────────────────────────\n\n  /**\n   * Case-insensitive string comparison.\n   * @param {string} a\n   * @param {string} b\n   * @returns {boolean}\n   */\n  static #ciEquals(a, b) {\n    return typeof a === 'string' && typeof b === 'string'\n      ? a.toLowerCase() === b.toLowerCase()\n      : a === b;\n  }\n\n  /**","sourceCodeStart":105,"sourceCodeEnd":141,"githubUrl":"https://github.com/usebruno/bruno/blob/9bdd81c7bdc57006e5f5ebffb79321a8d979f712/packages/bruno-js/src/header-list.js#L105-L141","documentation":"Thrown by HeaderList write methods (add, upsert, remove, clear, repopulate, populate, assimilate) when the HeaderList instance is in read-only mode. The #assertWritable guard at header-list.js:121-124 checks the private #writable flag, which is set to false for response header lists. Response headers are immutable snapshots; only request headers are writable.","triggerScenarios":"Calling res.getHeaderList().add('X-Custom', 'value') or any write method on res.headers / res.headerList. The HeaderList for responses is constructed with writable=false at header-list.js:118, so add/upsert/remove/clear all invoke #assertWritable and throw.","commonSituations":"Confusing request headers (writable) with response headers (read-only) and trying to modify the response header list. Attempting to set a header on the response in a post-response script. Using the same code path for req and res header lists without checking writability.","solutions":["Modify request headers instead: use req.headerList.add() / req.setHeader() for outgoing requests.","If you need to transform response headers for assertions, copy them to a plain object first instead of mutating the HeaderList.","Check writability before writing if unsure: if the list is from a response, treat it as read-only."],"exampleFix":"// before (post-response script)\nres.headerList.add('X-Custom', 'value'); // throws - response headers are read-only\n\n// after (pre-request script)\nreq.headerList.add('X-Custom', 'value'); // correct - request headers are writable","handlingStrategy":"validation","validationCode":"// Check if you are working with request or response headers\n// Response header lists are read-only; request header lists are writable.\n// In scripts, always write to req.headerList, never res.headerList.\n// No runtime API exposes the writable flag; the rule is: response = read-only.\nif (source === 'request') {\n  req.headerList.add('X-Custom', 'value'); // safe\n} else {\n  // copy response headers to a plain object for inspection instead\n  const headersCopy = { ...res.headerList.toObject() };\n}","typeGuard":null,"tryCatchPattern":"try {\n  headerList.add(key, value);\n} catch (e) {\n  if (e.message.includes('read-only')) {\n    console.error('Cannot modify response headers; they are immutable snapshots');\n  }\n}","preventionTips":["Never call write methods on res.headerList; response headers are read-only snapshots.","Only modify request headers via req.headerList or req.setHeader() in pre-request scripts.","Copy response headers to a plain object if you need to transform them for assertions."],"tags":["headers","response","read-only","headerlist","validation"],"backgroundTag":null,"analyzedSha":"9bdd81c7bdc57006e5f5ebffb79321a8d979f712","analyzedAt":"2026-08-13T04:09:25.751Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}