Merge pull request #5 from HarperFast/fix/proxy-strip-cdn-response-headers

fix(plugin): strip CDN-injected headers from miss-proxy responses (v0.3.1)

Author: harper-joseph

package-lock.json

@@ -1,6 +1,6 @@
 {
 	"name": "@harperfast/prerender",
-	"version": "0.3.0",
+	"version": "0.3.1",
 	"type": "module",
 	"description": "Configurable Harper plugin for prerendering pages for bots and crawlers",
 	"license": "Apache-2.0",

packages/plugin/package.json

@@ -83,11 +83,57 @@ const ignoredDownstreamRequestHeaders = () => {
 	return ignoredHeadersCache;
 };
 
+// Origin responses are relayed to the edge on a cache miss. The origin sits behind a CDN
+// (Akamai), so its response carries the CDN's own control headers (akamai-grn, x-akamai-*,
+// x-cache*, via, server-timing, …). When the edge's "Serve Alternate Response" swap re-adds
+// its own copies the response ends up with duplicated CDN headers, and the edge fails the
+// transform (ERR_SWAPFAIL_*|badxform). Relay only this allowlist of genuine origin-response
+// headers so the swapped-in response looks like a clean origin reply; everything else (CDN
+// headers, hop-by-hop headers, set-cookie) is dropped.
+//
+// server-timing is deliberately NOT relayed: the value from the origin is the staging edge's
+// own Akamai timing tokens, and the serving edge adds its own on egress — so dropping the
+// origin's avoids re-doubling it and keeps Akamai-internal tokens off the response.
+//
+// NOTE: unlike the render path (RenderJob.allowedResponseHeaders), which strips the origin
+// encoding and re-encodes stored pages itself, the proxy path relays content-encoding +
+// content-length for the passed-through body. See the accept-encoding note in
+// resolveUpstreamHeaders for why the origin body is fetched gzip (not brotli).
+const FORWARDED_RESPONSE_HEADERS = new Set([
+	'content-type',
+	'content-encoding',
+	'content-length',
+	'cache-control',
+	'expires',
+	'etag',
+	'last-modified',
+	'vary',
+	'x-robots-tag',
+	'retry-after',
+]);
+
+export const sanitizeOriginResponseHeaders = (headers) => {
+	const clean = {};
+	if (!headers) return clean;
+	// HTTP header names are case-insensitive; match the allowlist on a lowercased key
+	// (undici lowercases already, but a future caller may not).
+	for (const [key, value] of Object.entries(headers)) {
+		if (value === undefined) continue;
+		const name = key.toLowerCase();
+		if (FORWARDED_RESPONSE_HEADERS.has(name)) clean[name] = value;
+	}
+	return clean;
+};
+
 export const resolveUpstreamHeaders = (downstream, deviceType) => {
 	const upstream = {
 		'user-agent': config.userAgents[deviceType] ?? config.userAgents.desktop,
 		[config.securityToken.header]: config.securityToken.value,
-		'accept-encoding': 'br, gzip',
+		// Request gzip (not brotli) from the origin. On a cache miss this response is relayed
+		// to the Akamai edge for its "Serve Alternate Response" swap, and Akamai cannot apply
+		// its outgoing transform to a brotli-encoded alternate response (ERR_SWAPFAIL_*|badxform).
+		// gzip is transform-safe; the edge re-compresses (to br) for the real client on egress.
+		'accept-encoding': 'gzip',
 	};
 
 	if (downstream) {
@@ -120,17 +166,12 @@ export const fetchOriginResource = async (request) => {
 		body,
 	});
 
-	for (const key of hopByHopHeaders) {
-		delete response.headers[key];
-	}
-	delete response.headers['set-cookie'];
-
 	return {
 		miss: true,
 		url: urlObj.href,
 		deviceType,
 		statusCode: response.statusCode,
-		headers: response.headers,
+		headers: sanitizeOriginResponseHeaders(response.headers),
 		content: Readable.toWeb(response.body),
 		viaStaging: Boolean(stagingIp),
 	};

packages/plugin/src/util/upstream.js

@@ -1,7 +1,7 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import { applyOptions, config } from '../src/config.js';
-import { resolveUpstreamHeaders, stagingTargetIp } from '../src/util/upstream.js';
+import { resolveUpstreamHeaders, sanitizeOriginResponseHeaders, stagingTargetIp } from '../src/util/upstream.js';
 
 // Minimal stand-in for the request headers object (only `.get` is used here).
 const headersWith = (present) => ({ get: (name) => (present.includes(name) ? '1' : null) });
@@ -99,6 +99,58 @@ test('resolveUpstreamHeaders matches ignoredHeaders case-insensitively', () => {
 	assert.equal(upstream['x-internal'], undefined);
 });
 
+test('sanitizeOriginResponseHeaders keeps genuine origin headers', () => {
+	const clean = sanitizeOriginResponseHeaders({
+		'content-type': 'text/html; charset=utf-8',
+		'content-encoding': 'gzip',
+		'content-length': '1234',
+		'cache-control': 'max-age=60',
+		'etag': '"abc"',
+		'last-modified': 'Wed, 02 Jul 2026 00:00:00 GMT',
+		'vary': 'Accept-Encoding',
+		'x-robots-tag': 'noindex',
+	});
+	assert.equal(clean['content-type'], 'text/html; charset=utf-8');
+	assert.equal(clean['content-encoding'], 'gzip');
+	assert.equal(clean['content-length'], '1234');
+	assert.equal(clean['cache-control'], 'max-age=60');
+	assert.equal(clean['etag'], '"abc"');
+	assert.equal(clean['vary'], 'Accept-Encoding');
+	assert.equal(clean['x-robots-tag'], 'noindex');
+});
+
+test('sanitizeOriginResponseHeaders strips CDN/edge-injected headers (badxform cause)', () => {
+	const clean = sanitizeOriginResponseHeaders({
+		'content-type': 'text/html',
+		'akamai-grn': '0.1234abcd',
+		'x-akamai-staging': 'ESSL',
+		'x-akamai-transformed': '9 0 0',
+		'x-cache': 'TCP_MISS from a1-2-3-4',
+		'x-cache-key': '/L/1/2/3/foo',
+		'x-check-cacheable': 'NO',
+		'via': '1.1 akamai.net',
+		'server-timing': 'cdn-cache; desc=MISS',
+		'set-cookie': 'sid=abc; Path=/',
+		'connection': 'keep-alive',
+		// empty duplicated custom origin headers seen in the wild — must not be forwarded
+		'x-origin-cc': '',
+		'x-origin-ttl': '',
+	});
+	assert.deepEqual(Object.keys(clean), ['content-type']);
+});
+
+test('sanitizeOriginResponseHeaders returns {} for null/undefined input', () => {
+	assert.deepEqual(sanitizeOriginResponseHeaders(null), {});
+	assert.deepEqual(sanitizeOriginResponseHeaders(undefined), {});
+});
+
+test('sanitizeOriginResponseHeaders matches allowlist case-insensitively (normalizes key)', () => {
+	const clean = sanitizeOriginResponseHeaders({ 'Content-Type': 'text/html', 'X-Akamai-Staging': 'ESSL' });
+	assert.equal(clean['content-type'], 'text/html');
+	assert.equal(clean['x-akamai-staging'], undefined);
+	assert.equal(clean['X-Akamai-Staging'], undefined);
+});
+
 test('resolveUpstreamHeaders drops a spoofed token/debug header even when configured mixed-case', () => {
 	// Incoming keys are lowercased, so a mixed-case configured name must still match.
 	applyOptions({ securityToken: { header: 'X-Harper-Token', value: 'real' }, debugHeader: { key: 'X-Harper-Debug' } });