[GH-ISSUE #430] fix: strip credential headers from outbound requests in proxyExternalRequest #91

New issue

Closed

opened 2026-05-06 12:37:10 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-06 12:37:10 +02:00

Owner

Originally created by @Divkix on GitHub (Mar 11, 2026).
Original GitHub issue: https://github.com/cloudflare/vinext/issues/430

Problem

proxyExternalRequest in packages/vinext/src/config/config-matchers.ts forwards all request headers (except connection and x-middleware-*) to external origins on outbound proxy requests. This means authorization, cookie, and proxy-authorization headers from the original request are sent to third-party origins.

The HOP_BY_HOP_HEADERS filter only applies to the response (line ~999), not the outbound request (lines ~939-953).

Proposed Fix

Strip credential-bearing headers (authorization, cookie, proxy-authorization) from the outbound request in proxyExternalRequest before forwarding. This is a behavior change and should be behind a clear opt-in or at minimum well-documented.

References

PR review discussion on docs/external-rewrite-warning branch
Relevant code: packages/vinext/src/config/config-matchers.ts lines 939-953 (outbound headers), line 999 (response hop-by-hop filter)

Originally created by @Divkix on GitHub (Mar 11, 2026). Original GitHub issue: https://github.com/cloudflare/vinext/issues/430 ## Problem `proxyExternalRequest` in `packages/vinext/src/config/config-matchers.ts` forwards **all** request headers (except `connection` and `x-middleware-*`) to external origins on outbound proxy requests. This means `authorization`, `cookie`, and `proxy-authorization` headers from the original request are sent to third-party origins. The `HOP_BY_HOP_HEADERS` filter only applies to the **response** (line ~999), not the outbound request (lines ~939-953). ## Proposed Fix Strip credential-bearing headers (`authorization`, `cookie`, `proxy-authorization`) from the outbound request in `proxyExternalRequest` before forwarding. This is a behavior change and should be behind a clear opt-in or at minimum well-documented. ## References - PR review discussion on `docs/external-rewrite-warning` branch - Relevant code: `packages/vinext/src/config/config-matchers.ts` lines 939-953 (outbound headers), line 999 (response hop-by-hop filter)