The cache key for a deferred request: the exact tuple, length-prefixed, not a hash.
A non-cryptographic hash is forgeable and crypto.subtle.digest is async, while the key is
derived inside synchronous host calls. The length prefix makes the encoding injective for any
field contents; a separator is not enough because a body (attacker-controlled) can contain it.
The cache key for a deferred request: the exact tuple, length-prefixed, not a hash.
A non-cryptographic hash is forgeable and
crypto.subtle.digestis async, while the key is derived inside synchronous host calls. The length prefix makes the encoding injective for any field contents; a separator is not enough because a body (attacker-controlled) can contain it.