fix(fetch): only send Sec-Fetch-Mode to potentially trustworthy URLs

[kjsik11]

This relates to...

Refs #1305, in particular #1305 (comment).

Spec: https://w3c.github.io/webappsec-fetch-metadata/#abstract-opdef-append-the-fetch-metadata-headers-for-a-request

Rationale

appendFetchMetadata implements the Sec-Fetch-Mode sub-algorithm but skips step 1 of the outer algorithm, which the code marks as TODO:

To append the Fetch metadata headers for a request, given request r:

1. If r's url is not an potentially trustworthy URL, return.

So fetch('http://192.168.0.12/') sends sec-fetch-mode: cors, while browsers send no Sec-Fetch-* header to plain-http, non-loopback destinations. Reproduces on main and on the undici bundled with current Node releases.

Repro (Node built-ins only)

import http from 'node:http'
import os from 'node:os'
import { once } from 'node:events'

const lanIp = Object.values(os.networkInterfaces()).flat()
  .find((i) => i.family === 'IPv4' && !i.internal).address
const server = http.createServer((req, res) => {
  res.end(JSON.stringify({ 'sec-fetch-mode': req.headers['sec-fetch-mode'] ?? null }))
})
server.listen(0, lanIp)
await once(server, 'listening')
console.log(await (await fetch(`http://${lanIp}:${server.address().port}/`)).json())
server.close()

Prints { 'sec-fetch-mode': 'cors' }; with this PR the header is absent. https://, http://localhost and http://127.0.0.1 keep sending it.

Changes

• lib/web/fetch/util.js: early return using the existing isURLPotentiallyTrustworthy() helper on the request's current URL, so the gate applies per redirect hop (matches browsers and WPT fetch/metadata/redirect/*). The Sec-Fetch-Dest/Site/User TODOs are untouched and will inherit the gate.
• test/fetch/fetch-metadata.js (new): header absent for plain-http non-loopback origins, present for https:// and loopback, dropped/added across https -> http / http -> https redirects. 4 of the 7 cases fail on main.

Features

N/A

Bug Fixes

• Sec-Fetch-Mode is no longer sent to URLs that are not potentially trustworthy (plain http:///ws:// to non-loopback hosts), per Fetch Metadata step 1.

Breaking Changes and Deprecations

N/A

Test results (Node 24.20.0)

• npm run lint clean; test/fetch/fetch-metadata.js 7/7 (4/7 fail on main)
• test/fetch/*.js 483/483
• test/mock-agent.js 111/111, test/proxy-agent.js 38/38, test/eventsource/eventsource-connect.js 11/11 — every existing assertion on this header targets localhost

This fix was prepared with AI assistance; I reproduced the bug locally and reviewed every line.

Status

• I have read and agreed to the Developer's Certificate of Origin
• Tested
• [s] Benchmarked (optional)
• [s] Documented
• Review ready
• In review
• Merge ready

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.50%. Comparing base (fc3450d) to head (fe69384).
⚠️ Report is 25 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5738      +/-   ##
==========================================
+ Coverage   93.47%   93.50%   +0.03%     
==========================================
  Files         110      110              
  Lines       38908    39077     +169     
==========================================
+ Hits        36368    36538     +170     
+ Misses       2540     2539       -1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.