Repository navigation
fix(server): strip Expect and hop-by-hop headers from engine proxies - #6476
Open
sentry[bot] wants to merge 1 commit into
Open
sentry[bot] wants to merge 1 commit into
sentry[bot] wants to merge 1 commit into
Conversation
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub. 4 Skipped Deployments
|
Contributor
![diff-warden[bot]](https://avatars.githubusercontent.com/u/118544361?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Warden clearance. Complete security and confidentiality review of 61380344d19543496fa5aae6b84eb8f23dea4117 found no high or medium security findings and no confidentiality findings. Any new push dismisses this approval. Analysis run
Contributor
Warden: approvedNo high or medium security findings and no confidentiality findings. Reviewed |
This branch is waiting to be deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What is this about?
A crash in the OpenCode proxy in
apps/serverwhen a client sends a POST withExpect: 100-continue.What problem does it solve?
These requests failed with a 500 error. Node's built-in
fetch(backed by undici) rejects theExpectheader and throwsNotSupportedError: expect header not supported, which surfaces asTypeError: fetch failed.What was the situation before?
The proxy forwarded the incoming
Expectheader straight to the engine throughfetch. HTTP/1.1 clients sendingExpect: 100-continuegot an unhandled 500.How is this implemented?
forwardableProxyRequestHeadershelper stripsexpect, the connection and hop-by-hop headers (connection,keep-alive,proxy-connection,upgrade,te,trailer), and the transport headers (host,origin,transfer-encoding) before forwarding to the engine./workspace/:id/opencode/*) and the v2 proxy (/opencode2/*).apps/server/test/proxy-request-headers.test.tsverify that disallowed headers are stripped and that the remaining headers are forwarded safely.What else changed?
none
Release note
Requests with
Expect: 100-continuesent through the OpenCode proxy no longer fail with a 500 error.Fixes DESKTOP-APP-59
@sentry <feedback>: Autofix iterates on these changes@sentry stop iterating: Autofix stops iterating on this runThis PR was automatically generated by Sentry at no cost. You can adjust this setting at any time.