do not pass through host header

bluesky-social · Oct 12, 2023 · f984d2d · f984d2d
1 parent 83f6784
commit f984d2d
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/packages/xrpc-server/src/util.ts b/packages/xrpc-server/src/util.ts
@@ -24,7 +24,6 @@ import {
   InternalServerError,
   Options,
   XRPCError,
-  XRPCReqContext,
   HandlerPassthru,
   UpstreamFailureError,
   UpstreamTimeoutError,
@@ -301,6 +300,7 @@ export async function proxy(
       headers[name] = Array.isArray(value) ? value.join(', ') : value
     }
   }
+  delete headers['host']
   if (opts?.headers) {
     for (const [name, value] of Object.entries(opts.headers)) {
       headers[name.toLowerCase()] = value

diff --git a/packages/xrpc-server/tests/proxy.test.ts b/packages/xrpc-server/tests/proxy.test.ts
@@ -1,5 +1,6 @@
 import * as http from 'http'
 import getPort from 'get-port'
+import { wait } from '@atproto/common'
 import xrpc, { ServiceClient } from '@atproto/xrpc'
 import { createServer, closeServer } from './_util'
 import * as xrpcServer from '../src'
@@ -9,7 +10,6 @@ import { gzipSync } from 'zlib'
 import { cidForCbor } from '@atproto/common'
 import { XRPCError } from '@atproto/xrpc'
 import assert from 'assert'
-import { wait } from '@atproto/common'
 
 const LEXICONS = [
   {