Search code examples
javascriptnode.jscsrfqcross-site

NodeJS server "swallows" header field


I am creating a proxy server with nodejs. It works fine unless a CSRF token is required.

When making a request with the request plugin (https://github.com/request/request), the response object's header won#t continue x-csrf-token, even tho the req.header object made a "Fetch".

Any ideas?

app.use("/", function (req, res, next) {
    options = {
    'url': sDestination + req.url,
        'ca': cas,
        'jar': true,//jar,
        'strictSSL': true,
        'headers': {
    accept: '*/*'
        }
    };
    request(options, function (err, response, body) {
    if (err) { 
     console.error(err);
     }
    else {
     if (typeof req.headers['x-csrf-token'] === "string") {
    console.log("#1 " + (typeof req.headers['x-csrf-token'])); // string
     console.log("#2 " + (req.headers['x-csrf-token'])); // "Fetch"
     console.log("#3 " + (typeof response.headers['x-csrf-token'])); // undefined
     }
     }
    }).pipe(res);
}

Solution

  • This did the job:

    req.pipe(request(options, function (err, response, body) {
        if (err) {
            return console.error('upload failed:', err);
        }
    }), {end: (req.method === "GET" ? true : false)}).pipe(res);