`copy_safe_request()` sheds unrecognized but safe HTTP headers

[jeremystretch]

NetBox Edition

NetBox Community

NetBox Version

v4.5.3

Python Version

3.12

Steps to Reproduce

This was originally raised under netboxlabs/netbox-branching#434 but represents a limitation in NetBox core.

Our copy_safe_request() utility function responsible for creating pickle-safe copies of HTTP requests (e.g. for background jobs) replicates only the META values defined in HTTP_REQUEST_META_SAFE_COPY. Thus, arbitrary headers such as X-NetBox-Branch (used by netbox-branching to indicate the active branch) are discarded.

Expected Behavior

Arbitrary but safe HTTP headers (e.g. X-NetBox-Branch) should be copied to the resulting request. Presumably, we could allow all HTTP headers (META keys beginning with HTTP_) that are 1) strings and 2) not known to convey sensitive data (e.g. Authorization or Cookie).

Alternatively, we could introduce a configuration parameter to whitelist known-safe headers administratively.

Observed Behavior

Only the HTTP headers included in HTTP_REQUEST_META_SAFE_COPY are preserved.