disallow setting host header in fetch (#2322)

lib/fetch/index.js

@@ -1406,6 +1406,8 @@ async function httpNetworkOrCacheFetch (
     }
   }
 
+  httpRequest.headersList.delete('host')
+
   //    20. If includeCredentials is true, then:
   if (includeCredentials) {
     // 1. If the user agent is not configured to block cookies for httpRequest

test/fetch/issue-2318.js

@@ -0,0 +1,25 @@
+'use strict'
+
+const { test } = require('tap')
+const { once } = require('events')
+const { createServer } = require('http')
+const { fetch } = require('../..')
+
+test('Undici overrides user-provided `Host` header', async (t) => {
+  t.plan(1)
+
+  const server = createServer((req, res) => {
+    t.equal(req.headers.host, `localhost:${server.address().port}`)
+
+    res.end()
+  }).listen(0)
+
+  t.teardown(server.close.bind(server))
+  await once(server, 'listening')
+
+  await fetch(`http://localhost:${server.address().port}`, {
+    headers: {
+      host: 'www.idk.org'
+    }
+  })
+})