question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Authorization Header gets removed when passing request to server

See original GitHub issue

What is your Test Scenario?

When making a call to a backend api with authorization header, the call will go untouched to the backend server. Note this problem only started happening in version 1.8.5 (1.8.4 is working fine)

What is the Current behavior?

Example of curl req going through testcafe to httpbin.org Note the authorization header does not make it to httpbin.org

 curl 'http://<localhost ip>:49748/lRd4kqmG3/https://httpbin.org/headers' \
  -H 'Connection: keep-alive' \
  -H 'accept: application/json, text/plain, */*' \
  -H 'authorization: Bearer ya29.xxxxxxxxxxxxxx' \
  -H 'content-type: application/json;charset=UTF-8' \
  -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4156.0 Safari/537.36' \
  -H 'x-hammerhead-origin: https://my.website.com' \
  -H 'x-hammerhead-credentials: same-origin' \
  -H 'Referer: http://<localhost ip>:64928/HmgivWWBJ/https://my.website.com/' \
  -H 'Accept-Language: en-GB,en-US;q=0.9,en;q=0.8' \
  --compressed \
  --insecure
{
  "headers": {
    "Accept": "application/json, text/plain, */*",
    "Accept-Encoding": "deflate, gzip",
    "Accept-Language": "en-GB,en-US;q=0.9,en;q=0.8",
    "Content-Type": "application/json;charset=UTF-8",
    "Host": "httpbin.org",
    "Origin": "https://my.website.com",
    "Referer": "https://my.website.com/",
    "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4156.0 Safari/537.36",
    "X-Amzn-Trace-Id": "Root=1-5ecc53fb-b2c915fe220a7580f83xxxxx"
  }
}

What is the Expected behavior?

Expect the request to pass to backend server intact with all headers.

What is your web application and your TestCafe test code?

Your website URL (or attach your complete example):
Your complete test code (or attach your test files):
 
Your complete configuration file (if any):

Your complete test report:

Screenshots:

Steps to Reproduce:

see curl above

Your Environment details:

  • testcafe version: 1.8.5

  • node.js version: 10.16.3 / 12.16.1

  • command-line arguments: testcafe chromium:headless tests/** -s path=reports,takeOnFails=true --reporter html:reports/report.html --skip-js-errors

  • browser name and version: Chromium 85.0.4156.0

  • platform and version: macOS Version 10.15.4

  • other:

Issue Analytics

  • State:closed
  • Created 3 years ago
  • Reactions:7
  • Comments:13 (4 by maintainers)

github_iconTop GitHub Comments

3reactions
anna-gladushko-haparacommented, Jun 2, 2020

We also use fetch on the client side and experience the same problem in 1.8.5

3reactions
prizovcommented, Jun 2, 2020

We use axios and fetch on the client side. And we are experiencing problem only with fetch request. authorization header is not get wrapped in x-hammerhead-authorization. Looks like something related to fetch processing was changed in 1.8.5 release since this problem doesn’t exist in 1.8.4

Read more comments on GitHub >

github_iconTop Results From Across the Web

C# HttpClient authorization header removed after send to server
I know that when redirection occurs, authorization header removed for security reason. Also I'm not sure about redirect in external API.
Read more >
Authorization Header Missing Upon NGINX Proxy Pass to ...
An Authorization header can be lost if you are 1) requesting auth and passing the Authorization header using different protocols (HTTP/HTTPS); 2 ...
Read more >
Authorization header removed from companion request #2089
The companion endpoint requires authentication via header and this is having a problem. It looks like this: Uppy performs OPTIONS request, which ...
Read more >
Authorization - HTTP - MDN Web Docs - Mozilla
The HTTP Authorization request header can be used to provide credentials that authenticate a user agent with a server, allowing access to a ......
Read more >
how to remove Authorization http header - DevCentral
Hi. I'm testing the IRule functionality. I do radius authentication of the virtual server and then the request is passing to a pool....
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found