Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Caseless header comparing in HTTP adapter. #2880

Merged

Conversation

mastermatt
Copy link
Contributor

@mastermatt mastermatt commented Apr 7, 2020

It was adding User-Agent and removing Authorization, but only when
existing headers had the exact right casing. Node uses caseless logic
when managing headers.

This was causing some requests to have User-Agent appended to the
headers object and overriding provided agent strings.

Also included is an update to not override the Content-Length if it
was already defined in the options. It can be desirable to manually
specify a content length that does not match the data on hand.
Especially for testing.

Ref: #1237 (dup #2876) (stale PR #1291) nock/nock#1969 nock/nock#1845 https://github.com/sendgrid/sendgrid-nodejs/issues/1083

It was adding User-Agent and removing Authorization, but only when
existing headers had the exact right casing. Node uses caseless logic
when managing headers.

This was causing some requests to have `User-Agent` appended to the
headers object and overriding provided agent strings.

Also included is an update to not override the `Content-Length` if it
was already defined in the options. It can be desirable to manually
specify a content length that does not match the data on hand.
Especially for testing.
@chinesedfan
Copy link
Collaborator

@mastermatt What do you think about using lib/helpers/normalizeHeaderName.js, and there are 2 places merging for headers,

  • lib/core/mergeConfig.js
  • lib/core/dispatchRequest.js

Then both adapters, xhr and http, can be unchanged.

@mastermatt
Copy link
Contributor Author

I'd be happy to look at alternative ways of doing this so the adapters don't drift. I didn't want to touch the XHR since I don't know the inner workings as well.
That being said, the approach behind normalizeHeaderName isn't one I'm a fan of.

While HTTP headers are case-insensitive, not every client and server is perfect about following this (take this PR for example). As such if a user of this client explicitly passes a header, that casing should be maintained across the wire.

It's a subtle, but important distinction that my change does not modify the provided headers, just updates the internal logic around adding defaults.

That being said, looking at the callers of normalizeHeaderName as well as the two places @chinesedfan pointed out that mergers headers, does concern me. The merging is not done in a case-insensitive manner and the normalization is destructive.

This project really does probably need a proper header helper/utility class, like in #1291, but that PR has been sitting for two years.
This PR isn't a holistic fix, but will fix the majority of the issues I've seen in the Node community.

@jasonsaayman
Copy link
Member

Please can you fix the test in this branch, update it to the latest master, and let me know so I can review it fully.

@mastermatt
Copy link
Contributor Author

@jasonsaayman updated and ready to review. I had to merge a conflict with #3703. Tests from both PRs now pass.

mbargiel pushed a commit to mbargiel/axios that referenced this pull request Jan 27, 2022
* Caseless header comparing in HTTP adapter.

It was adding User-Agent and removing Authorization, but only when
existing headers had the exact right casing. Node uses caseless logic
when managing headers.

This was causing some requests to have `User-Agent` appended to the
headers object and overriding provided agent strings.

Also included is an update to not override the `Content-Length` if it
was already defined in the options. It can be desirable to manually
specify a content length that does not match the data on hand.
Especially for testing.

* Fix eslint error

* fixup: update state UA logic

Play nice with axios#3703

Co-authored-by: Jay <jasonsaayman@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
No open projects
v0.20.0
  
Done
Development

Successfully merging this pull request may close these issues.

None yet

3 participants