Repository navigation
[Bug]: proxy forwards headers named by Connection #47770
Description
Description
ProxyUtil.headers() removes the fixed hop-by-hop header set, but it leaves extension headers named by the incoming Connection header.
For example, with Connection: x-hop, the Connection header is removed while X-Hop: must-not-forward is still sent upstream. RFC 9110 §7.6.1 requires an intermediary to remove every field named by Connection before forwarding. Both HTTP proxy call sites use this helper.
Steps to reproduce
-
From
packages/opencode, run:bun -e 'import { ProxyUtil } from "./src/server/proxy-util.ts"; console.log(Object.fromEntries(ProxyUtil.headers({ connection: "x-hop", "x-hop": "must-not-forward", "x-end": "keep" })))'
-
Observe that the result still contains
x-hop:{ "x-end": "keep", "x-hop": "must-not-forward" }
Expected: connection and x-hop are absent, while x-end remains.
Operating System
All platforms
Activity
opencodejr commentedon Oct 28, 2026
Thanks for the clear report and the reproduction.
packages/opencode/src/server/proxy-util.ts(ProxyUtil.headers()) belongs to OpenCode v1 (theopencode-ai0.x/1.x line). v1 only gets fixes for critical bugs such as data loss, security problems or crashes with no workaround, so this is unlikely to be fixed there.OpenCode v2 (
@opencode/cli) is a separate implementation, and its HTTP proxy already does what you expect:forwardedHeadersinpackages/plugin-browser/src/proxy.tsremoves every header named inConnectionbefore dropping the standard hop-by-hop headers. We recommend upgrading to v2.If you think this is critical in v1 (for example, if it leaks something sensitive upstream), or you can reproduce it on v2, please reply here with the details.
Related:
opencodejr commentedon Oct 29, 2026
Closing this as not planned.
ProxyUtil.headers()is part of OpenCode v1, and v1 only gets fixes for critical bugs. Forwarding headers named byConnectionis a real RFC 9110 deviation but doesn't reach that bar. v2's HTTP proxy already removes headers named inConnectionbefore forwarding, so upgrading to v2 should resolve this.Thanks again for the precise report and reproduction. If you can reproduce this on v2, or find that it has a security impact in v1, please open a new issue or comment here with the details.