Authorization Header gets removed when passing request to server
See original GitHub issueWhat is your Test Scenario?
When making a call to a backend api with authorization header, the call will go untouched to the backend server. Note this problem only started happening in version 1.8.5 (1.8.4 is working fine)
What is the Current behavior?
Example of curl req going through testcafe to httpbin.org Note the authorization header does not make it to httpbin.org
curl 'http://<localhost ip>:49748/lRd4kqmG3/https://httpbin.org/headers' \
-H 'Connection: keep-alive' \
-H 'accept: application/json, text/plain, */*' \
-H 'authorization: Bearer ya29.xxxxxxxxxxxxxx' \
-H 'content-type: application/json;charset=UTF-8' \
-H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4156.0 Safari/537.36' \
-H 'x-hammerhead-origin: https://my.website.com' \
-H 'x-hammerhead-credentials: same-origin' \
-H 'Referer: http://<localhost ip>:64928/HmgivWWBJ/https://my.website.com/' \
-H 'Accept-Language: en-GB,en-US;q=0.9,en;q=0.8' \
--compressed \
--insecure
{
"headers": {
"Accept": "application/json, text/plain, */*",
"Accept-Encoding": "deflate, gzip",
"Accept-Language": "en-GB,en-US;q=0.9,en;q=0.8",
"Content-Type": "application/json;charset=UTF-8",
"Host": "httpbin.org",
"Origin": "https://my.website.com",
"Referer": "https://my.website.com/",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4156.0 Safari/537.36",
"X-Amzn-Trace-Id": "Root=1-5ecc53fb-b2c915fe220a7580f83xxxxx"
}
}
What is the Expected behavior?
Expect the request to pass to backend server intact with all headers.
What is your web application and your TestCafe test code?
Your website URL (or attach your complete example):
Your complete test code (or attach your test files):
Your complete configuration file (if any):
Your complete test report:
Screenshots:
Steps to Reproduce:
see curl above
Your Environment details:
-
testcafe version: 1.8.5
-
node.js version: 10.16.3 / 12.16.1
-
command-line arguments: testcafe chromium:headless tests/** -s path=reports,takeOnFails=true --reporter html:reports/report.html --skip-js-errors
-
browser name and version: Chromium 85.0.4156.0
-
platform and version: macOS Version 10.15.4
-
other:
Issue Analytics
- State:
- Created 3 years ago
- Reactions:7
- Comments:13 (4 by maintainers)
Top Results From Across the Web
C# HttpClient authorization header removed after send to server
I know that when redirection occurs, authorization header removed for security reason. Also I'm not sure about redirect in external API.
Read more >Authorization Header Missing Upon NGINX Proxy Pass to ...
An Authorization header can be lost if you are 1) requesting auth and passing the Authorization header using different protocols (HTTP/HTTPS); 2 ...
Read more >Authorization header removed from companion request #2089
The companion endpoint requires authentication via header and this is having a problem. It looks like this: Uppy performs OPTIONS request, which ...
Read more >Authorization - HTTP - MDN Web Docs - Mozilla
The HTTP Authorization request header can be used to provide credentials that authenticate a user agent with a server, allowing access to a ......
Read more >how to remove Authorization http header - DevCentral
Hi. I'm testing the IRule functionality. I do radius authentication of the virtual server and then the request is passing to a pool....
Read more >Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start FreeTop Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Top GitHub Comments
We also use fetch on the client side and experience the same problem in 1.8.5
We use axios and fetch on the client side. And we are experiencing problem only with fetch request.
authorization
header is not get wrapped inx-hammerhead-authorization
. Looks like something related to fetch processing was changed in 1.8.5 release since this problem doesn’t exist in 1.8.4