Skip to content

FIX: Don't break on invalid headers#1395

Open
asbermudez wants to merge 3 commits intohttp-party:masterfrom
asbermudez:bugfix/warn-on-invalid-header
Open

FIX: Don't break on invalid headers#1395
asbermudez wants to merge 3 commits intohttp-party:masterfrom
asbermudez:bugfix/warn-on-invalid-header

Conversation

@asbermudez
Copy link
Copy Markdown

Have found that in some scenarios the proxied server does return invalid characters in the headers, like here:
nodejs/node#21509

In the current version the proxy does break when a invalid character is found with a
[ERR_INVALID_CHAR]: Invalid character in header content

This PR aims to avoid the total crash of the application and instead show a warning in the console and process all what can be processed.

@asbermudez
Copy link
Copy Markdown
Author

The build seems to be breaking because of something I haven't changed... 🤷‍♂

@jsmylnycky
Copy link
Copy Markdown
Contributor

Thanks @asbermudez This looks reasonable enough to me. The fail in CI is only during the Node 6 pipeline...but it's past due that Node 6 support is killed off, in my opinion.

@asbermudez
Copy link
Copy Markdown
Author

To add some more info, this error specially happens with proxied requests to servers "protected" with Incapsula.
Apparently they do use that invalid character to prevent bots from parsing the page by generating this exception with it.

@asbermudez
Copy link
Copy Markdown
Author

@codecov-io
Copy link
Copy Markdown

codecov-io commented Nov 11, 2019

Codecov Report

Merging #1395 into master will decrease coverage by 0.26%.
The diff coverage is 66.66%.

Impacted file tree graph

@@            Coverage Diff             @@
##           master    #1395      +/-   ##
==========================================
- Coverage   92.35%   92.08%   -0.27%     
==========================================
  Files           6        6              
  Lines         314      316       +2     
==========================================
+ Hits          290      291       +1     
- Misses         24       25       +1
Impacted Files Coverage Δ
lib/http-proxy/passes/web-outgoing.js 98.07% <66.66%> (-1.93%) ⬇️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 9bbe486...b30ecfd. Read the comment docs.

@sshishov
Copy link
Copy Markdown

Hello, when this PR will be merged?

As we are having the same exact issue and this PR addresses it.

The issue is related to the response from Incapsula CDN. We do not want to remove this header as it protects from some bots. We already using --insecure-http-parser and fetch is working as expected. But unfortunately proxy is not working.

@doctornkz
Copy link
Copy Markdown

Hello! Do we have any plans to merge it? We are having a problem with security scanner, it's sending malformed headers and we are getting a storm of exceptions. It's should work more graceful.

@dipiash
Copy link
Copy Markdown

dipiash commented Jun 20, 2022

Hello! Do you have any plans to merge it?

We have the same problems

@TkDodo
Copy link
Copy Markdown

TkDodo commented Aug 30, 2023

we've also run into this problem, and we are now applying the fix from this PR via patch-package.

would be good to see this merged sometime, thank you 🙏

@conradkirschner
Copy link
Copy Markdown

@jsmylnycky I was running into this issue and would wish a flag to disable this exception for invalid headers
(or this got merged somehow )

@jsmylnycky
Copy link
Copy Markdown
Contributor

@jsmylnycky I was running into this issue and would wish a flag to disable this exception for invalid headers (or this got merged somehow )

Apologies but I'm no longer involved in this project. You'll need to reach out to the current maintainers.

@codecov-commenter
Copy link
Copy Markdown

codecov-commenter commented Jan 23, 2025

⚠️ Please install the 'codecov app svg image' to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 66.66667% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 92.08%. Comparing base (9bbe486) to head (b30ecfd).
⚠️ Report is 3 commits behind head on master.

Files with missing lines Patch % Lines
lib/http-proxy/passes/web-outgoing.js 66.66% 1 Missing ⚠️
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.
Additional details and impacted files
@@            Coverage Diff             @@
##           master    #1395      +/-   ##
==========================================
- Coverage   92.35%   92.08%   -0.27%     
==========================================
  Files           6        6              
  Lines         314      316       +2     
==========================================
+ Hits          290      291       +1     
- Misses         24       25       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@doctornkz-intelas
Copy link
Copy Markdown

RIP

pi0 added a commit to unjs/httpxy that referenced this pull request Mar 25, 2026
catch ERR_INVALID_CHAR errors from res.setHeader() when upstream servers
return headers with invalid characters (e.g. control chars), instead of
crashing the proxy. Invalid headers are silently skipped.

ref: http-party/node-http-proxy#1395
pi0 added a commit to unjs/httpxy that referenced this pull request Mar 25, 2026
…ly (#106)

catch ERR_INVALID_CHAR errors from res.setHeader() when upstream servers
return headers with invalid characters (e.g. control chars), instead of
crashing the proxy. Invalid headers are silently skipped.

ref: http-party/node-http-proxy#1395
@pi0
Copy link
Copy Markdown

pi0 commented Mar 25, 2026

This issue has been fixed in unjs/httpxy#106.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.