Skip to content

Forbidden proxy response header combination on non-success #6256

@rjonsson

Description

@rjonsson

We've encountered a bug with the non-success proxy behaviour from nango.

When we get a non-success response with the header transfer-encoding included , nango just copies all the headers and sends them with Express, which itself will automatically include content-length header as well.

const responseHeaders = error.response?.headers || {};
void logCtx.error('Failed with this body', { body: parsedBody });
res.status(responseStatus).set(responseHeaders).send(data);

These two are mutually exclusive as per RFC 7230 §3.3.2. and should not be in the same response.

These headers are rejected by Axios and throws, which is bad handling from axios but that's besides the point.

There might be other headers that should be filtered maybe security wise but this is the one causing a problem for us.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions