Mercurial > njs

changeset 2113:4aed0532158c

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Fetch: removed special treatment of forbidden headers. In c43261bad627 (0.7.10), a notion of forbidden headers was introduced in accordance in Fetch API. In the API the Forbidden headers are not allowed to be changed from JavaScript code for security reasons. The restriction is removed because there are use cases where Host (which is considered forbidden) is different from the host address in URL and JavaScript code is expected to be a trusted source (unlike a browser context). This closes #638 issue on Github.
author Dmitry Volyntsev <xeioex@nginx.com>
date Tue, 09 May 2023 22:09:13 -0700
parents 70e7701a4588
children 89c821242caf
files nginx/ngx_js_fetch.c
diffstat 1 files changed, 0 insertions(+), 65 deletions(-) [+]
line wrap: on
line diff
--- a/nginx/ngx_js_fetch.c	Tue May 09 18:58:52 2023 -0700
+++ b/nginx/ngx_js_fetch.c	Tue May 09 22:09:13 2023 -0700
@@ -2184,43 +2184,6 @@
     ngx_uint_t        i;
     ngx_js_tb_elt_t  *h, **ph;
     ngx_list_part_t  *part;
-    const njs_str_t  *f;
-
-    static const njs_str_t forbidded_request[] = {
-        njs_str("Accept-Charset"),
-        njs_str("Accept-Encoding"),
-        njs_str("Access-Control-Request-Headers"),
-        njs_str("Access-Control-Request-Method"),
-        njs_str("Connection"),
-        njs_str("Content-Length"),
-        njs_str("Cookie"),
-        njs_str("Date"),
-        njs_str("DNT"),
-        njs_str("Expect"),
-        njs_str("Host"),
-        njs_str("Keep-Alive"),
-        njs_str("Origin"),
-        njs_str("Referer"),
-        njs_str("Set-Cookie"),
-        njs_str("TE"),
-        njs_str("Trailer"),
-        njs_str("Transfer-Encoding"),
-        njs_str("Upgrade"),
-        njs_str("Via"),
-        njs_null_str,
-    };
-
-    static const njs_str_t forbidded_response[] = {
-        njs_str("Set-Cookie"),
-        njs_str("Set-Cookie2"),
-        njs_null_str,
-    };
-
-    static const njs_str_t forbidded_request_prefix[] = {
-        njs_str("proxy-"),
-        njs_str("sec-"),
-        njs_null_str,
-    };
 
     ngx_js_http_trim(&value, &vlen, 0);
 
@@ -2253,34 +2216,6 @@
         return NJS_ERROR;
     }
 
-    if (headers->guard == GUARD_REQUEST) {
-        for (f = &forbidded_request[0]; f->length != 0; f++) {
-            if (len == f->length
-                && (njs_strncasecmp(name, f->start, len) == 0))
-            {
-                return NJS_OK;
-            }
-        }
-
-        for (f = &forbidded_request_prefix[0]; f->length != 0; f++) {
-            if (len >= f->length
-                && (njs_strncasecmp(name, f->start, f->length) == 0))
-            {
-                return NJS_OK;
-            }
-        }
-    }
-
-    if (headers->guard == GUARD_RESPONSE) {
-        for (f = &forbidded_response[0]; f->length != 0; f++) {
-            if (len == f->length
-                && (njs_strncasecmp(name, f->start, len) == 0))
-            {
-                return NJS_OK;
-            }
-        }
-    }
-
     ph = NULL;
     part = &headers->header_list.part;
     h = part->elts;