title: Reading response headers with Fetch API
body: <p>I'm in a Google Chrome extension with permissions for <code>"*://*/*"</code> and I'm trying to make the switch from XMLHttpRequest to the <a href="https://developers.google.com/web/updates/2015/03/introduction-to-fetch" rel="noreferrer">Fetch API</a>.</p>
  
  <p>The extension stores user-input login data that used to be put directly into the XHR's open() call for HTTP Auth, but under Fetch can no longer be used directly as a parameter. For HTTP Basic Auth, circumventing this limitation is trivial, as you can manually set an Authorization header:</p>
  
  <pre><code>fetch(url, {
    headers: new Headers({ 'Authorization': 'Basic ' + btoa(login + ':' + pass) })
    } });
  </code></pre>
  
  <p><a href="https://en.wikipedia.org/wiki/Digest_access_authentication#Example_with_explanation" rel="noreferrer">HTTP Digest Auth</a> however requires more interactivity; you need to read parameters that the server sends you with its 401 response to craft a valid authorization token. I've tried reading the <code>WWW-Authenticate</code> response header field with this snippet:</p>
  
  <pre><code>fetch(url).then(function(resp) {
    resp.headers.forEach(function(val, key) { console.log(key + ' -&gt; ' + val); });
  }
  </code></pre>
  
  <p>But all I get is this output:</p>
  
  <pre><code>content-type -&gt; text/html; charset=iso-8859-1
  </code></pre>
  
  <p>Which by itself is correct, but that's still missing around 6 more fields according to Chrome's Developer Tools. If I use <code>resp.headers.get("WWW-Authenticate")</code> (or any of the other fields for that matter), i get only <code>null</code>.</p>
  
  <p>Any chance of getting to those other fields using the Fetch API?</p>