The response headers a render is allowed to set on the way out.
x-drupal-* (browser-facing headers such as X-Drupal-Ajax-Token, which ajax.js needs) and the
names in MODULE_HEADER_NAMES (a policy a module sets). The prefix and the list are the
boundary: arbitrary headers could set set-cookie, location or CORS.
Parameters
raw: unknown
Whatever the render fragment reported, which is unvalidated JSON.
Returns Record<string,string>
Header name to value, lowercased, with anything outside the prefix and the list dropped.
The response headers a render is allowed to set on the way out.
x-drupal-*(browser-facing headers such asX-Drupal-Ajax-Token, which ajax.js needs) and the names inMODULE_HEADER_NAMES(a policy a module sets). The prefix and the list are the boundary: arbitrary headers could setset-cookie,locationor CORS.