Search code examples
node.jsproxyrequestcsrfcsrf-protection

Why does a remote's server response does not contain an x-csrf-token on nodejs after fetch request?


I am using nodejs and the request plugin (https://github.com/request/request) for creating an proxy. The routing all works fine, but one of the servers my proxy should forward to requires CSRF Tokens. Problem is, that fetch requests are being sent, but the Server response doesn't contain x-csrf-token. It seems like the request plugin is "swalling" this field. I mean, it's no empty response, no. The header doesn't even contain the field.

I have to use the request plugin for reasons. So switching the plugin is no help. Any ideas on what can cause this problem?

UPDATE (sample code)

app.use(sIncoming, function (req, res, next) {
options = {
    'url': sDestination + req.url,
    'ca': cas,
    'jar': true,// enable cookies,
    'strictSSL': true,
    'headers': {
        accept: '*/*'
    }
};
request(options, function (err, response, body) {
    if (err) onsole.error(err);
    else {
         if (typeof req.headers['x-csrf-token'] === "string") {
                console.log("#1 " + (typeof req.headers['x-csrf-token'])); // string
                console.log("#2 " + (req.headers['x-csrf-token'])); // fetch
                console.log("#3 " + (typeof response.headers['x-csrf-token'])); //undefined

    }
}).pipe(res);

Solution

  •    req.pipe(request(options, function (err, response, body) {
            if (err) {
                return console.error('upload failed:', err);
            }
       }), {end: (req.method === "GET" ? true : false)}).pipe(res);
    

    did it