fix: revive dead FormData Content-Type warning (#6067)

The logWarning() in Body::Body that warns when a FormData body is paired
with a custom Content-Type header was dead code. The comparison used
ConstMimeType::operator==(kj::StringPtr), which compared the full
substring after '/' against the subtype — so 'form-data; boundary=...'
never matched 'form-data'.

Fix the comparison by parsing the content-type string into a MimeType
first, then comparing against MimeType::FORM_DATA. The MimeType equality
operator correctly ignores MIME parameters like boundary.

Also remove ConstMimeType::operator==(kj::StringPtr) entirely — it was a
footgun with only this one (buggy) caller, and any future use would hit
the same parameter-ignoring trap.

Add a streaming tail worker test that verifies the warning is emitted and
captured in the tracing system when a Request is constructed with a
FormData body and a custom Content-Type header.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: harrishancock

src/workerd/api/cache.c++

@@ -335,6 +335,9 @@ jsg::Promise<void> Cache::put(jsg::Lock& js,
       // this behavior. Silently discarding 304s maintains backwards compatibility and is actually
       // still spec-conformant.
 
+      // TODO(cleanup): This guard predates streaming tail workers. logWarning() already emits to
+      // the tracer when one exists, so this check suppresses the warning for tail-worker-only
+      // users. Consider replacing with a check that also accounts for getWorkerTracer().
       if (context.isInspectorEnabled()) {
         context.logWarning(
             "Ignoring attempt to Cache.put() a 304 status response. 304 responses "

src/workerd/api/headers.c++

@@ -275,6 +275,9 @@ static_assert(std::size(COMMON_HEADER_NAMES) == (Headers::MAX_COMMON_HEADER_ID +
 
 void maybeWarnIfBadHeaderString(kj::StringPtr name, kj::StringPtr str) {
   KJ_IF_SOME(context, IoContext::tryCurrent()) {
+    // TODO(cleanup): This guard predates streaming tail workers. logWarning() already emits to
+    // the tracer when one exists, so this check suppresses the warning for tail-worker-only
+    // users. Consider replacing with a check that also accounts for getWorkerTracer().
     if (context.isInspectorEnabled()) {
       if (!simdutf::validate_ascii(str.begin(), str.size())) {
         // The string contains non-ASCII characters. While any 8-bit value is technically valid

src/workerd/api/http.c++

@@ -174,14 +174,16 @@ Body::Body(jsg::Lock& js, kj::Maybe<ExtractedBody> init, Headers& headers)
             // The spec allows the user to override the Content-Type, if they wish, so we only set
             // the Content-Type if it doesn't already exist.
             headers.setCommon(capnp::CommonHeaderName::CONTENT_TYPE, kj::mv(ct));
-          } else if (MimeType::FORM_DATA == ct) {
-            // Custom content-type request/responses with FormData are broken since they require a
-            // boundary parameter only the FormData serializer can provide. Let's warn if a dev does this.
-            IoContext::current().logWarning(
-                "A FormData body was provided with a custom Content-Type header when constructing "
-                "a Request or Response object. This will prevent the recipient of the Request or "
-                "Response from being able to parse the body. Consider omitting the custom "
-                "Content-Type header.");
+          } else KJ_IF_SOME(parsed, MimeType::tryParse(ct)) {
+            if (MimeType::FORM_DATA == parsed) {
+              // Custom content-type request/responses with FormData are broken since they require a
+              // boundary parameter only the FormData serializer can provide. Let's warn if a dev does this.
+              IoContext::current().logWarning(
+                  "A FormData body was provided with a custom Content-Type header when constructing "
+                  "a Request or Response object. This will prevent the recipient of the Request or "
+                  "Response from being able to parse the body. Consider omitting the custom "
+                  "Content-Type header.");
+            }
           }
         }
         return kj::mv(i.impl);
@@ -271,6 +273,9 @@ jsg::Promise<kj::String> Body::text(jsg::Lock& js) {
       // search-and-replace across your whole site and you forgot that it'll apply to images too.
       // When running in the fiddle, let's warn the developer if they do this.
       auto& context = IoContext::current();
+      // TODO(cleanup): This guard predates streaming tail workers. logWarning() already emits to
+      // the tracer when one exists, so this check suppresses the warning for tail-worker-only
+      // users. Consider replacing with a check that also accounts for getWorkerTracer().
       if (context.isInspectorEnabled()) {
         KJ_IF_SOME(type, headersRef.getCommon(js, capnp::CommonHeaderName::CONTENT_TYPE)) {
           maybeWarnIfNotText(js, type);
@@ -1058,6 +1063,9 @@ jsg::Ref<Response> Response::constructor(jsg::Lock& js,
           "Response with null body status (101, 204, 205, or 304) cannot have a body.");
 
       auto& context = IoContext::current();
+      // TODO(cleanup): This guard predates streaming tail workers. logWarning() already emits to
+      // the tracer when one exists, so this check suppresses the warning for tail-worker-only
+      // users. Consider replacing with a check that also accounts for getWorkerTracer().
       if (context.isInspectorEnabled()) {
         context.logWarning(kj::str("Constructing a Response with a null body status (", statusCode,
             ") and a non-null, "

src/workerd/api/streams/internal.c++

@@ -23,6 +23,9 @@ namespace {
 // papers over is fixed.
 [[noreturn]] void throwTypeErrorAndConsoleWarn(kj::StringPtr message) {
   KJ_IF_SOME(context, IoContext::tryCurrent()) {
+    // TODO(cleanup): This guard predates streaming tail workers. logWarning() already emits to
+    // the tracer when one exists, so this check suppresses the warning for tail-worker-only
+    // users. Consider replacing with a check that also accounts for getWorkerTracer().
     if (context.isInspectorEnabled()) {
       context.logWarning(message);
     }
@@ -918,6 +921,10 @@ ReadableStreamController::Tee ReadableStreamInternalController::tee(jsg::Lock& j
       auto makeTee = [&](kj::Own<ReadableStreamSource> b1,
                          kj::Own<ReadableStreamSource> b2) -> Tee {
         doClose(js);
+        // TODO(cleanup): This guard predates streaming tail workers. The WarnIfUnusedStream
+        // wrapper calls logWarning(), which already emits to the tracer when one exists, so this
+        // check suppresses the warning for tail-worker-only users. Consider replacing with a
+        // check that also accounts for getWorkerTracer().
         if (ioContext.isInspectorEnabled()) {
           b1 = kj::heap<WarnIfUnusedStream>(js, kj::mv(b1), ioContext);
           b2 = kj::heap<WarnIfUnusedStream>(js, kj::mv(b2), ioContext);

src/workerd/api/tests/BUILD.bazel

@@ -270,6 +270,15 @@ wd_test(
     data = ["form-data-test-ts.ts"],
 )
 
+wd_test(
+    src = "warnings-test.wd-test",
+    args = ["--experimental"],
+    data = [
+        "warnings-tail.js",
+        "warnings-test.js",
+    ],
+)
+
 wd_test(
     size = "large",
     src = "global-scope-test.wd-test",

src/workerd/api/tests/warnings-tail.js

@@ -0,0 +1,69 @@
+// Copyright (c) 2026 Cloudflare, Inc.
+// Licensed under the Apache 2.0 license found in the LICENSE file or at:
+//     https://opensource.org/licenses/Apache-2.0
+import * as assert from 'node:assert';
+
+// ================================================================================================
+// Expected warnings registry.
+//
+// Add new entries here when introducing logWarning() calls. Each entry is a substring that must
+// appear in at least one warn-level tail event's message. The trigger worker (warnings-test.js)
+// must exercise a code path that produces each warning.
+//
+// At present, the FormData warning is the only logWarning() call that is easily testable here.
+// Several other warnings (e.g. .text() on non-text body, null-body status with zero-length body,
+// Cache.put() with 304, non-ASCII header values) are guarded by isInspectorEnabled() checks that
+// predate streaming tail workers. Those guards suppress the warning for tail-worker-only users.
+// If we relax those checks (see TODO(cleanup) comments at each site), we could add tests for
+// those warnings here too.
+const EXPECTED_WARNINGS = [
+  // From Body::Body (http.c++) — FormData body with a custom Content-Type header.
+  'FormData body was provided',
+];
+// ================================================================================================
+
+let allEvents = [];
+
+export default {
+  tailStream(event) {
+    allEvents.push(event.event);
+    return (event) => {
+      allEvents.push(event.event);
+    };
+  },
+};
+
+export const test = {
+  async test() {
+    // HACK: Tail events from the trigger worker's fetch invocation are delivered asynchronously
+    // across service boundaries. There is no JS-level synchronization primitive to await their
+    // arrival — a plain `await promise` doesn't drive the I/O loop that delivers them. We must
+    // use scheduler.wait() to yield while the runtime processes pending I/O.
+    const TIMEOUT_MS = 5000;
+    const POLL_MS = 10;
+    const deadline = Date.now() + TIMEOUT_MS;
+
+    const unseen = () =>
+      EXPECTED_WARNINGS.filter(
+        (substring) =>
+          !allEvents.some(
+            (e) =>
+              e.type === 'log' &&
+              e.level === 'warn' &&
+              e.message?.[0]?.includes(substring)
+          )
+      );
+
+    while (unseen().length > 0 && Date.now() < deadline) {
+      await scheduler.wait(POLL_MS);
+    }
+
+    const missing = unseen();
+    assert.strictEqual(
+      missing.length,
+      0,
+      `${missing.length} expected warning(s) were not observed after ${TIMEOUT_MS}ms:\n` +
+        missing.map((s) => `  - "${s}"`).join('\n')
+    );
+  },
+};

src/workerd/api/tests/warnings-test.js

@@ -0,0 +1,27 @@
+// Copyright (c) 2026 Cloudflare, Inc.
+// Licensed under the Apache 2.0 license found in the LICENSE file or at:
+//     https://opensource.org/licenses/Apache-2.0
+
+export default {
+  async fetch(request) {
+    const formData = new FormData();
+    formData.append('key', 'value');
+    // Constructing a Request with a FormData body and a custom Content-Type header should
+    // produce a logWarning, because the custom Content-Type will lack the boundary parameter
+    // that the FormData serializer generates, preventing the recipient from parsing the body.
+    const req = new Request('http://example.com', {
+      method: 'POST',
+      body: formData,
+      headers: { 'Content-Type': 'multipart/form-data' },
+    });
+    return new Response('ok');
+  },
+};
+
+export const test = {
+  async test(ctrl, env) {
+    // Invoke via service binding so the fetch() handler runs in a traced invocation
+    // (test() handlers are intentionally not traced by the test runner).
+    await env.SELF.fetch('http://dummy');
+  },
+};

src/workerd/api/tests/warnings-test.wd-test

@@ -0,0 +1,26 @@
+using Workerd = import "/workerd/workerd.capnp";
+
+const unitTests :Workerd.Config = (
+  services = [
+    ( name = "trigger",
+      worker = (
+        modules = [
+          ( name = "worker", esModule = embed "warnings-test.js" )
+        ],
+        bindings = [
+          ( name = "SELF", service = "trigger" ),
+        ],
+        compatibilityFlags = ["experimental", "nodejs_compat"],
+        streamingTails = ["tail"],
+      ),
+    ),
+    ( name = "tail",
+      worker = (
+        modules = [
+          ( name = "worker", esModule = embed "warnings-tail.js" )
+        ],
+        compatibilityFlags = ["experimental", "nodejs_compat"],
+      ),
+    ),
+  ],
+);

src/workerd/util/mimetype.h

@@ -32,14 +32,6 @@ class ConstMimeType final {
     return this == &other || (type_ == other.type_ && subtype_ == other.subtype_);
   }
 
-  inline bool operator==(kj::StringPtr other) const {
-    KJ_IF_SOME(slashPos, other.findFirst('/')) {
-      return strcaseeq(type_, other.first(slashPos)) &&
-          strcaseeq(subtype_, other.slice(slashPos + 1));
-    }
-    return false;
-  }
-
   bool operator==(const MimeType& other) const;
   operator MimeType() const;
   MimeType clone() const;