Merge pull request #6070 from cloudflare/harris/2026-02-13-fix-form-data-warning

fix: revive dead FormData Content-Type warning (#6067)

Author: harrishancock

src/workerd/api/cache.c++

@@ -335,7 +335,7 @@ jsg::Promise<void> Cache::put(jsg::Lock& js,
       // this behavior. Silently discarding 304s maintains backwards compatibility and is actually
       // still spec-conformant.
 
-      if (context.isInspectorEnabled()) {
+      if (context.hasWarningHandler()) {
         context.logWarning(
             "Ignoring attempt to Cache.put() a 304 status response. 304 responses "
             "are not meaningful to cache, and a potential source of bugs. Consider validating that "

src/workerd/api/headers.c++

@@ -275,7 +275,7 @@ static_assert(std::size(COMMON_HEADER_NAMES) == (Headers::MAX_COMMON_HEADER_ID +
 
 void maybeWarnIfBadHeaderString(kj::StringPtr name, kj::StringPtr str) {
   KJ_IF_SOME(context, IoContext::tryCurrent()) {
-    if (context.isInspectorEnabled()) {
+    if (context.hasWarningHandler()) {
       if (!simdutf::validate_ascii(str.begin(), str.size())) {
         // The string contains non-ASCII characters. While any 8-bit value is technically valid
         // in HTTP headers, we encode header strings as UTF-8, so we want to warn the user that

src/workerd/api/http.c++

@@ -174,14 +174,16 @@ Body::Body(jsg::Lock& js, kj::Maybe<ExtractedBody> init, Headers& headers)
             // The spec allows the user to override the Content-Type, if they wish, so we only set
             // the Content-Type if it doesn't already exist.
             headers.setCommon(capnp::CommonHeaderName::CONTENT_TYPE, kj::mv(ct));
-          } else if (MimeType::FORM_DATA == ct) {
-            // Custom content-type request/responses with FormData are broken since they require a
-            // boundary parameter only the FormData serializer can provide. Let's warn if a dev does this.
-            IoContext::current().logWarning(
-                "A FormData body was provided with a custom Content-Type header when constructing "
-                "a Request or Response object. This will prevent the recipient of the Request or "
-                "Response from being able to parse the body. Consider omitting the custom "
-                "Content-Type header.");
+          } else KJ_IF_SOME(parsed, MimeType::tryParse(ct)) {
+            if (MimeType::FORM_DATA == parsed) {
+              // Custom content-type request/responses with FormData are broken since they require a
+              // boundary parameter only the FormData serializer can provide. Let's warn if a dev does this.
+              IoContext::current().logWarning(
+                  "A FormData body was provided with a custom Content-Type header when constructing "
+                  "a Request or Response object. This will prevent the recipient of the Request or "
+                  "Response from being able to parse the body. Consider omitting the custom "
+                  "Content-Type header.");
+            }
           }
         }
         return kj::mv(i.impl);
@@ -271,7 +273,7 @@ jsg::Promise<kj::String> Body::text(jsg::Lock& js) {
       // search-and-replace across your whole site and you forgot that it'll apply to images too.
       // When running in the fiddle, let's warn the developer if they do this.
       auto& context = IoContext::current();
-      if (context.isInspectorEnabled()) {
+      if (context.hasWarningHandler()) {
         KJ_IF_SOME(type, headersRef.getCommon(js, capnp::CommonHeaderName::CONTENT_TYPE)) {
           maybeWarnIfNotText(js, type);
         }
@@ -1058,7 +1060,7 @@ jsg::Ref<Response> Response::constructor(jsg::Lock& js,
           "Response with null body status (101, 204, 205, or 304) cannot have a body.");
 
       auto& context = IoContext::current();
-      if (context.isInspectorEnabled()) {
+      if (context.hasWarningHandler()) {
         context.logWarning(kj::str("Constructing a Response with a null body status (", statusCode,
             ") and a non-null, "
             "zero-length body. This is technically incorrect, and we recommend you update your "

src/workerd/api/streams/internal.c++

@@ -23,7 +23,7 @@ namespace {
 // papers over is fixed.
 [[noreturn]] void throwTypeErrorAndConsoleWarn(kj::StringPtr message) {
   KJ_IF_SOME(context, IoContext::tryCurrent()) {
-    if (context.isInspectorEnabled()) {
+    if (context.hasWarningHandler()) {
       context.logWarning(message);
     }
   }
@@ -918,7 +918,7 @@ ReadableStreamController::Tee ReadableStreamInternalController::tee(jsg::Lock& j
       auto makeTee = [&](kj::Own<ReadableStreamSource> b1,
                          kj::Own<ReadableStreamSource> b2) -> Tee {
         doClose(js);
-        if (ioContext.isInspectorEnabled()) {
+        if (ioContext.hasWarningHandler()) {
           b1 = kj::heap<WarnIfUnusedStream>(js, kj::mv(b1), ioContext);
           b2 = kj::heap<WarnIfUnusedStream>(js, kj::mv(b2), ioContext);
         }

src/workerd/api/tests/BUILD.bazel

@@ -270,6 +270,15 @@ wd_test(
     data = ["form-data-test-ts.ts"],
 )
 
+wd_test(
+    src = "warnings-test.wd-test",
+    args = ["--experimental"],
+    data = [
+        "warnings-tail.js",
+        "warnings-test.js",
+    ],
+)
+
 wd_test(
     size = "large",
     src = "global-scope-test.wd-test",

src/workerd/api/tests/warnings-tail.js

@@ -0,0 +1,68 @@
+// Copyright (c) 2026 Cloudflare, Inc.
+// Licensed under the Apache 2.0 license found in the LICENSE file or at:
+//     https://opensource.org/licenses/Apache-2.0
+import * as assert from 'node:assert';
+
+// ================================================================================================
+// Expected warnings registry.
+//
+// Add new entries here when introducing logWarning() calls. Each entry is a substring that must
+// appear in at least one warn-level tail event's message. The trigger worker (warnings-test.js)
+// must exercise a code path that produces each warning.
+//
+// NOTE: Some logWarning() calls go through jsg::Lock::logWarning() instead of
+// IoContext::logWarning(). The jsg path does not currently emit to the tracer, so those warnings
+// are not observable via tail workers and cannot be tested here (e.g. .text() on non-text body).
+const EXPECTED_WARNINGS = [
+  // From Body::Body (http.c++) — FormData body with a custom Content-Type header.
+  'FormData body was provided',
+  // From Response constructor (http.c++) — null-body status with zero-length body.
+  'Constructing a Response with a null body status',
+];
+// ================================================================================================
+
+let allEvents = [];
+
+export default {
+  tailStream(event) {
+    allEvents.push(event.event);
+    return (event) => {
+      allEvents.push(event.event);
+    };
+  },
+};
+
+export const test = {
+  async test() {
+    // HACK: Tail events from the trigger worker's fetch invocation are delivered asynchronously
+    // across service boundaries. There is no JS-level synchronization primitive to await their
+    // arrival — a plain `await promise` doesn't drive the I/O loop that delivers them. We must
+    // use scheduler.wait() to yield while the runtime processes pending I/O.
+    const TIMEOUT_MS = 5000;
+    const POLL_MS = 10;
+    const deadline = Date.now() + TIMEOUT_MS;
+
+    const unseen = () =>
+      EXPECTED_WARNINGS.filter(
+        (substring) =>
+          !allEvents.some(
+            (e) =>
+              e.type === 'log' &&
+              e.level === 'warn' &&
+              e.message?.[0]?.includes(substring)
+          )
+      );
+
+    while (unseen().length > 0 && Date.now() < deadline) {
+      await scheduler.wait(POLL_MS);
+    }
+
+    const missing = unseen();
+    assert.strictEqual(
+      missing.length,
+      0,
+      `${missing.length} expected warning(s) were not observed after ${TIMEOUT_MS}ms:\n` +
+        missing.map((s) => `  - "${s}"`).join('\n')
+    );
+  },
+};

src/workerd/api/tests/warnings-test.js

@@ -0,0 +1,33 @@
+// Copyright (c) 2026 Cloudflare, Inc.
+// Licensed under the Apache 2.0 license found in the LICENSE file or at:
+//     https://opensource.org/licenses/Apache-2.0
+
+export default {
+  async fetch(request) {
+    // --- FormData body with custom Content-Type (http.c++) ---
+    // The custom Content-Type will lack the boundary parameter that the FormData serializer
+    // generates, preventing the recipient from parsing the body.
+    const formData = new FormData();
+    formData.append('key', 'value');
+    const req = new Request('http://example.com', {
+      method: 'POST',
+      body: formData,
+      headers: { 'Content-Type': 'multipart/form-data' },
+    });
+
+    // --- Null-body status with zero-length body (http.c++) ---
+    // Constructing a Response with a null-body status (204) and a non-null, zero-length body
+    // is technically incorrect and should warn.
+    const resp = new Response('', { status: 204 });
+
+    return new Response('ok');
+  },
+};
+
+export const test = {
+  async test(ctrl, env) {
+    // Invoke via service binding so the fetch() handler runs in a traced invocation
+    // (test() handlers are intentionally not traced by the test runner).
+    await env.SELF.fetch('http://dummy');
+  },
+};

src/workerd/api/tests/warnings-test.wd-test

@@ -0,0 +1,26 @@
+using Workerd = import "/workerd/workerd.capnp";
+
+const unitTests :Workerd.Config = (
+  services = [
+    ( name = "trigger",
+      worker = (
+        modules = [
+          ( name = "worker", esModule = embed "warnings-test.js" )
+        ],
+        bindings = [
+          ( name = "SELF", service = "trigger" ),
+        ],
+        compatibilityFlags = ["experimental", "nodejs_compat"],
+        streamingTails = ["tail"],
+      ),
+    ),
+    ( name = "tail",
+      worker = (
+        modules = [
+          ( name = "worker", esModule = embed "warnings-tail.js" )
+        ],
+        compatibilityFlags = ["experimental", "nodejs_compat"],
+      ),
+    ),
+  ],
+);

src/workerd/io/io-context.c++

@@ -394,6 +394,11 @@ bool IoContext::isFiddle() {
   return thread.isFiddle();
 }
 
+bool IoContext::hasWarningHandler() {
+  return isInspectorEnabled() || getWorkerTracer() != kj::none ||
+      ::kj::_::Debug::shouldLog(::kj::LogSeverity::INFO);
+}
+
 void IoContext::logWarning(kj::StringPtr description) {
   KJ_REQUIRE_NONNULL(currentLock).logWarning(description);
 }

src/workerd/io/io-context.h

@@ -326,12 +326,17 @@ class IoContext final: public kj::Refcounted, private kj::TaskSet::ErrorHandler
   bool isInspectorEnabled();
   bool isFiddle();
 
-  // Log a warning to the inspector. This is a no-op if the inspector is not enabled.
+  // Returns true if there is something listening for warnings — the Chrome DevTools inspector,
+  // a streaming tail worker tracer, or --verbose stderr logging. Use this to guard expensive
+  // warning-message construction that should be skipped when nobody would see the result.
+  bool hasWarningHandler();
+
+  // Log a warning. Emits to the Chrome DevTools inspector (if connected), stderr, and to the
+  // streaming tail worker tracer (if active).
   void logWarning(kj::StringPtr description);
 
-  // Log a warning to the inspector. This is a no-op if the inspector is not enabled. Deduplicates
-  // warning messages such that a single unique message will only be logged once for the lifetime of
-  // an isolate.
+  // Log a warning, deduplicating so that each unique message is only logged once for the lifetime
+  // of an isolate. Emits to the same destinations as logWarning().
   void logWarningOnce(kj::StringPtr description);
 
   // Log an internal error message. Deduplicates log messages such that a single unique message will