144 lines
3.4 KiB
TypeScript
144 lines
3.4 KiB
TypeScript
// Allowlist: only these headers are forwarded to prevent leaking
|
|
// Vercel internal metadata, credentials, and infrastructure info
|
|
const ALLOWED_HEADERS = new Set([
|
|
// Standard request headers
|
|
"content-type",
|
|
"accept",
|
|
"accept-encoding",
|
|
"accept-language",
|
|
"user-agent",
|
|
"referer",
|
|
"origin",
|
|
// Auth headers (but NOT cookies)
|
|
"authorization",
|
|
"proxy-authorization",
|
|
// Content negotiation
|
|
"cache-control",
|
|
// Custom headers (no prefix restriction, but Vercel-specific are blocked)
|
|
]);
|
|
|
|
// Blocklist: sensitive headers that should NEVER be forwarded
|
|
const BLOCKED_HEADERS = new Set([
|
|
// Vercel infrastructure headers
|
|
"x-vercel-id",
|
|
"x-vercel-deployment-url",
|
|
"x-vercel-oidc-token",
|
|
"x-vercel-oidc-token-ts",
|
|
"x-vercel-signature",
|
|
"x-vercel-edgified",
|
|
"x-vercel-ip-city",
|
|
"x-vercel-ip-country",
|
|
"x-vercel-ip-country-region",
|
|
"x-vercel-ip-latency",
|
|
"x-vercel-deployment-config",
|
|
"x-vercel-rewritten-query",
|
|
// Cloudflare specific
|
|
"cf-ray",
|
|
"cf-connecting-ip",
|
|
"cf-ipcountry",
|
|
"cf-ray-id",
|
|
// Forwarding proxies (can leak internal network info)
|
|
"x-forwarded-for",
|
|
"x-forwarded-host",
|
|
"x-forwarded-proto",
|
|
"forwarded",
|
|
// Cookies (should be explicitly handled, not blindly forwarded)
|
|
"cookie",
|
|
"set-cookie",
|
|
// Internal infrastructure
|
|
"x-real-ip",
|
|
"x-cluster-client-ip",
|
|
// Authentication tokens
|
|
"x-api-key",
|
|
// Caching
|
|
"x-cache",
|
|
]);
|
|
|
|
// Internal relay headers
|
|
const INTERNAL_HEADERS = new Set([
|
|
"x-relay-target",
|
|
"x-relay-path",
|
|
"host",
|
|
]);
|
|
|
|
export interface RelayOptions {
|
|
stripHeaders?: string[];
|
|
}
|
|
|
|
export function isAllowedTarget(url: string): boolean {
|
|
try {
|
|
const parsed = new URL(url);
|
|
// Only allow HTTP/HTTPS (prevents file://, data:, etc.)
|
|
return ["http:", "https:"].includes(parsed.protocol);
|
|
} catch {
|
|
return false;
|
|
}
|
|
}
|
|
|
|
export function normalizeTargetUrl(
|
|
target: string | null,
|
|
relayPath: string,
|
|
): string | null {
|
|
if (!target) return null;
|
|
return target.replace(/\/$/, "") + relayPath;
|
|
}
|
|
|
|
export function filterHeaders(headers: Headers): Headers {
|
|
const filtered = new Headers();
|
|
|
|
for (const [key, value] of headers.entries()) {
|
|
const lowerKey = key.toLowerCase();
|
|
|
|
// Skip internal relay headers
|
|
if (INTERNAL_HEADERS.has(lowerKey)) continue;
|
|
|
|
// Skip blocked headers (security critical)
|
|
if (BLOCKED_HEADERS.has(lowerKey)) continue;
|
|
|
|
// Block headers with sensitive infrastructure prefixes
|
|
if (lowerKey.startsWith("x-vercel-")) continue;
|
|
if (lowerKey.startsWith("cf-")) continue;
|
|
if (lowerKey.startsWith("x-forwarded-")) continue;
|
|
|
|
// For known safe headers, always allow
|
|
if (ALLOWED_HEADERS.has(lowerKey)) {
|
|
filtered.set(key, value);
|
|
continue;
|
|
}
|
|
|
|
// Allow custom headers (no sensitive prefix)
|
|
// Custom headers typically use kebab-case (e.g., x-custom-header)
|
|
filtered.set(key, value);
|
|
}
|
|
|
|
return filtered;
|
|
}
|
|
|
|
export function stripRelayHeaders(headers: Headers): Headers {
|
|
// Use the secure filter instead of manual deletion
|
|
return filterHeaders(headers);
|
|
}
|
|
|
|
export function shouldSendBody(method: string): boolean {
|
|
return method !== "GET" && method !== "HEAD";
|
|
}
|
|
|
|
export function buildRelayRequest(
|
|
req: Request,
|
|
_headers: Headers,
|
|
): RequestInit {
|
|
return {
|
|
method: req.method,
|
|
headers: _headers,
|
|
body: shouldSendBody(req.method) ? req.body : undefined,
|
|
duplex: "half" as const,
|
|
};
|
|
}
|
|
|
|
export function createRelayResponse(response: Response): Response {
|
|
return new Response(response.body, {
|
|
status: response.status,
|
|
headers: response.headers,
|
|
});
|
|
}
|