chore: strip Authorization header on ws redirect (#29246)

This commit is contained in:
Dmitry Gozman 2024-01-30 14:26:25 -08:00 committed by GitHub
parent be6ab76c04
commit aeafd44726
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194

View File

@ -114,8 +114,10 @@ export class WebSocketTransport implements ConnectionTransport {
});
if (result.redirect) {
// Strip access key headers from the redirected request.
const newHeaders = Object.fromEntries(Object.entries(headers || {}).filter(([name]) => !name.includes('access-key')));
// Strip authorization headers from the redirected request.
const newHeaders = Object.fromEntries(Object.entries(headers || {}).filter(([name]) => {
return !name.includes('access-key') && name.toLowerCase() !== 'authorization';
}));
return WebSocketTransport._connect(progress, result.redirect.headers.location!, newHeaders, { follow: true, hadRedirects: true }, debugLogHeader);
}