fix(proxy): strip hop-by-hop request headers (RFC 7230) (#804)

Author: harlan-zw

packages/script/src/runtime/server/proxy-handler.ts

@@ -26,6 +26,17 @@ interface ProxyConfig {
 constCOMPRESSION_RE=/gzip|deflate|br|compress|base64/i
 constCLIENT_HINT_VERSION_RE=/;v="(\d+)\.[^"]*"/g
 constSKIP_RESPONSE_HEADERS=newSet(['set-cookie','transfer-encoding','content-encoding','content-length'])
+// Hop-by-hop request headers per RFC 7230 §6.1 — must not be forwarded by a proxy
+exportconstSKIP_REQUEST_HEADERS=newSet([
+'connection',
+'keep-alive',
+'proxy-authenticate',
+'proxy-authorization',
+'te',
+'trailer',
+'transfer-encoding',
+'upgrade',
+])
 
 /**
  * Strip fingerprinting from URL query string.
@@ -144,6 +155,13 @@ export default defineEventHandler(async (event) => {
 
 constheaders: Record<string,string>={}
 
+// Collect additional hop-by-hop headers named in the Connection header value (RFC 7230 §6.1).
+// e.g. `Connection: keep-alive, X-Custom` → also strip `X-Custom`.
+constconnectionHeaderValue=originalHeaders.connection
+constconnectionNamedHeaders=connectionHeaderValue
+ ? newSet(connectionHeaderValue.split(',').map(h=>h.trim().toLowerCase()).filter(Boolean))
+ : null
+
 // Process headers based on per-flag privacy
 for(const[key,value]ofObject.entries(originalHeaders)){
 if(!value)
@@ -154,6 +172,14 @@ export default defineEventHandler(async (event) => {
 if(lowerKey==='host')
 continue
 
+// Hop-by-hop headers (RFC 7230 §6.1) — never forward
+if(SKIP_REQUEST_HEADERS.has(lowerKey))
+continue
+
+// Headers listed in the Connection header are also hop-by-hop
+if(connectionNamedHeaders?.has(lowerKey))
+continue
+
 // SENSITIVE_HEADERS always stripped regardless of privacy flags
 if(SENSITIVE_HEADERS.includes(lowerKey))
 continue

test/unit/proxy-handler-hop-by-hop.test.ts

@@ -0,0 +1,142 @@
+importtype{Server}from'node:http'
+import{createServer,requestashttpRequest}from'node:http'
+import{createApp,toNodeListener}from'h3'
+import{afterAll,beforeAll,beforeEach,describe,expect,it,vi}from'vitest'
+
+/**
+ * Tests for #791: proxy handler must strip hop-by-hop request headers per RFC 7230 §6.1.
+ *
+ * Hop-by-hop headers are connection-specific and must not be forwarded by a proxy:
+ * connection, keep-alive, proxy-authenticate, proxy-authorization,
+ * te, trailer, transfer-encoding, upgrade
+ *
+ * Additionally, any header named in the `Connection` header value must also be stripped.
+ */
+
+vi.mock('nitropack/runtime',()=>({
+useRuntimeConfig: ()=>({
+'nuxt-scripts-proxy': {
+proxyPrefix: '/_scripts/p',
+domainPrivacy: {
+'upstream.test': false,
+},
+privacy: false,
+debug: false,
+},
+}),
+useNitroApp: ()=>({
+hooks: {callHook: async()=>{}},
+}),
+}))
+
+describe('proxy handler - hop-by-hop request headers (#791)',()=>{
+letproxyServer: Server
+letproxyPort: number
+letSKIP_REQUEST_HEADERS: Set<string>
+
+// Intercept the fetch call inside the handler so we can inspect the headers
+// that would actually be forwarded upstream (before the Node http client
+// re-adds its own connection/host headers).
+letlastForwardedHeaders: Record<string,string>={}
+letupstreamServer: Server
+letupstreamPort: number
+letrealFetch: typeofglobalThis.fetch
+
+beforeAll(async()=>{
+upstreamServer=createServer((_req,res)=>{
+res.writeHead(200,{'content-type': 'application/json'})
+res.end('{}')
+})
+awaitnewPromise<void>(resolve=>upstreamServer.listen(0,resolve))
+upstreamPort=(upstreamServer.address()asany).port
+
+realFetch=globalThis.fetch
+globalThis.fetch=async(input: any,init?: any)=>{
+constreqUrl=typeofinput==='string' ? input : input.url
+consturl=newURL(reqUrl)
+if(url.hostname==='upstream.test'){
+// Capture the headers the proxy intended to forward
+consthdrs=(init?.headers??{})asRecord<string,string>
+lastForwardedHeaders={ ...hdrs}
+constredirected=`http://127.0.0.1:${upstreamPort}${url.pathname}${url.search}`
+returnrealFetch(redirected,{ ...init,headers: {}})
+}
+returnrealFetch(input,init)
+}
+
+constmod=awaitimport('../../packages/script/src/runtime/server/proxy-handler')
+SKIP_REQUEST_HEADERS=mod.SKIP_REQUEST_HEADERS
+
+constapp=createApp()
+app.use(mod.default)
+proxyServer=createServer(toNodeListener(app))
+awaitnewPromise<void>(resolve=>proxyServer.listen(0,resolve))
+proxyPort=(proxyServer.address()asany).port
+})
+
+beforeEach(()=>{
+lastForwardedHeaders={}
+})
+
+afterAll(()=>{
+if(realFetch)
+globalThis.fetch=realFetch
+upstreamServer?.close()
+proxyServer?.close()
+})
+
+it('exports SKIP_REQUEST_HEADERS containing all RFC 7230 §6.1 hop-by-hop headers',()=>{
+expect(SKIP_REQUEST_HEADERS).toBeInstanceOf(Set)
+for(consthof[
+'connection',
+'keep-alive',
+'proxy-authenticate',
+'proxy-authorization',
+'te',
+'trailer',
+'transfer-encoding',
+'upgrade',
+]){
+expect(SKIP_REQUEST_HEADERS.has(h)).toBe(true)
+}
+})
+
+// Use raw http.request because undici (global fetch) rejects forbidden hop-by-hop request headers.
+functionrawGet(headers: Record<string,string>){
+returnnewPromise<void>((resolve,reject)=>{
+constreq=httpRequest({
+host: '127.0.0.1',
+port: proxyPort,
+path: '/_scripts/p/upstream.test/collect',
+method: 'GET',
+ headers,
+},(res)=>{
+res.resume()
+res.on('end',()=>resolve())
+})
+req.on('error',reject)
+req.end()
+})
+}
+
+it('strips hop-by-hop request headers before forwarding upstream',async()=>{
+awaitrawGet({
+'connection': 'keep-alive, X-Custom-Hop',
+'keep-alive': 'timeout=5',
+'proxy-authorization': 'Bearer secret',
+'te': 'trailers',
+'x-custom-hop': 'should-not-forward',
+'accept': 'application/json',
+'user-agent': 'test-agent',
+})
+
+for(consthof['connection','keep-alive','proxy-authorization','te','trailer','transfer-encoding','upgrade']){
+expect(lastForwardedHeaders[h],`hop-by-hop "${h}" should not be forwarded`).toBeUndefined()
+}
+// Header named in Connection header is stripped too
+expect(lastForwardedHeaders['x-custom-hop']).toBeUndefined()
+// Non-hop-by-hop headers pass through
+expect(lastForwardedHeaders.accept).toBe('application/json')
+expect(lastForwardedHeaders['user-agent']).toBe('test-agent')
+})
+})