fix(proxy): don't forward the caller's Cookie/Origin to the target#125
Open
matthewhardern wants to merge 2 commits into
Open
fix(proxy): don't forward the caller's Cookie/Origin to the target#125matthewhardern wants to merge 2 commits into
matthewhardern wants to merge 2 commits into
Conversation
The /proxy route copied the caller's request headers via new Headers(req.headers) and only *overrode* Cookie/Origin/Referer when X-Sender-* was present — so a browser's own (localhost) cookies leaked to the proxied third-party target. This (a) leaks session/analytics cookies to a third party and (b) trips the target's WAF: easyeda's CloudFront returns 403 when the forwarded request carries the caller's localhost cookies, breaking JLCPCB component import in tsci dev / the hosted editor. Clear inherited Cookie/Origin/Referer (and Sec-Fetch-* fetch metadata) before applying X-Sender-* overrides, making X-Sender-* the sole source of those request-identity headers. Adds regression tests.
imrishabh18
reviewed
May 29, 2026
Address review: replace the inline Bun.serve mock servers in proxy.test.ts with a reusable getFakeTargetServer fixture. Also adds a WAF-style test (403 on any forwarded Cookie -> 200 after the fix) using the same fixture.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
/proxyroute copied the caller's headers vianew Headers(req.headers)and only overrodeCookie/Origin/Refererwhen the matchingX-Sender-*header was present, so when it wasn't, the caller's own headers leaked through to the proxied third-party targettsci dev/ the hosted editor this forwards the browser's localhost cookies (cookie-consent + PostHog analytics) toeasyeda.com; easyeda's CloudFront WAF rejects the request with403, breaking JLCPCB component import. It also leaks session/analytics cookies to a third partyCookie/Origin/Referer(and theSec-Fetch-*fetch-metadata headers) before applyingX-Sender-*, makingX-Sender-*the sole source of those request-identity headersCookie/Originare not forwarded;X-Sender-Cookie/X-Sender-Originstill areRepro: with an accumulated browser cookie,
POST /proxytoX-Target-Url: https://easyeda.com/api/components/searchreturns 403; the identical request without the caller cookie returns 200. Bisecting showed the forwardedCookiewas the trigger (not IP, rate-limiting, CORS, or TLS fingerprint).Testing
bun test tests/routes/proxy.test.tsbunx tsc --noEmit