-
fix(ingress): forward all headers in WebSocket proxy (#1058)
frostbyte_neo 发布于
2026-06-22 02:27:17 +00:00 - fix(ingress): forward all headers in WebSocket proxy instead of hardcoded whitelist
The WebSocket proxy only forwarded Origin, Sec-WebSocket-Protocol, and
Cookie headers to the backend, silently dropping all others. This caused
execd to reject PTY WebSocket connections with 401 because the
X-EXECD-ACCESS-TOKEN header never reached it.Replace the whitelist with a blacklist that skips only hop-by-hop headers
(RFC 7230 §6.1) and WebSocket handshake headers managed by the dialer,
matching httputil.ReverseProxy behavior on the HTTP path.Closes #1050
Co-Authored-By: Claude Opus 4.6 noreply@anthropic.com
- style(ingress): fix gofmt alignment in header.go
Co-Authored-By: Claude Opus 4.6 noreply@anthropic.com
- fix(ingress): also strip headers named by Connection tokens per RFC 7230
Parse Connection header values and skip any header listed as a
connection token, in addition to the fixed hop-by-hop set.Co-Authored-By: Claude Opus 4.6 noreply@anthropic.com
- fix(ingress): strip Proxy-Connection header in WebSocket proxy
Add Proxy-Connection to the hop-by-hop blacklist so proxy-aware clients'
Proxy-Connection headers are not forwarded to sandbox backends, consistent
with net/http/httputil.ReverseProxy behavior.Co-Authored-By: Claude Opus 4.6 noreply@anthropic.com
Co-authored-by: Claude Opus 4.6 noreply@anthropic.com
下载附件