fix(node): read duplicate single-value headers from rawHeaders in get/has#217
Merged
Conversation
…/has Node collapses headers it treats as single-value (authorization, content-type, …) to their first occurrence in `req.headers`. The fast path in `get`/`has`/`getSetCookie` read that collapsed object, so the return value diverged from WHATWG `Headers` (which joins all occurrences) until the Headers object was iterated and `_headers` was materialized from `rawHeaders`. Route these methods through `_headers` consistently so the result no longer depends on prior iteration order. Co-Authored-By: Claude Fable 5 <[email protected]>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
👮 Files not reviewed due to content moderation or server errors (2)
📝 Walkthrough
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
commit: |
pi0
approved these changes
Jul 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
On the Node adapter,
NodeRequestHeaders.get()/has()/getSetCookie()had a fast path that read Node's collapsedreq.headersobject before_headerswas materialized. For headers Node treats as single-value (authorization,content-type, …), Node keeps only the first occurrence, whereas therawHeaders-materialized_headersappends all occurrences, matching WHATWGHeaders.As a result,
get('authorization')returned a different value depending on whether the Headers object had been iterated first:This is a spec divergence and a header-confusion primitive: two layers reading the same header can disagree if one reads before iteration and the other after. Reproduced end-to-end against a live Node server over a raw socket (duplicate
Authorization/Content-Typelines — a normal fetch client can't send these).Fix
Route
get()/has()/getSetCookie()through therawHeaders-materialized_headersconsistently, dropping theif (this.#headers)fast branches. The result no longer depends on prior iteration order and matches nativeHeaders.Node adapter only — other adapters (Deno/Bun/Cloudflare/Bunny/generic/AWS-Lambda) use native
Request/Headersand are unaffected.Tests
test/node-headers.test.tssending duplicateauthorization/content-typeheaders and asserting the joined value both before and after iteration.beforeandafterboth return the joined value and match nativeHeaders.🤖 Generated with Claude Code