fix: filters cookies with the payload- prefix in getExternalFile by default

packages/payload/src/uploads/getExternalFile.ts

@@ -22,7 +22,14 @@ export const getExternalFile = async ({ data, req, uploadConfig }: Args): Promis
 
     const headers = uploadConfig.externalFileHeaderFilter
       ? uploadConfig.externalFileHeaderFilter(Object.fromEntries(new Headers(req.headers)))
-      : { cookie: req.headers.get('cookie')! }
+      : {
+          cookie:
+            req.headers
+              .get('cookie')
+              ?.split(';')
+              .filter((cookie) => !cookie.trim().startsWith(req.payload.config.cookiePrefix))
+              .join(';') || '',
+        }
 
     // Check if URL is allowed because of skipSafeFetch allowList
     const skipSafeFetch: boolean =

packages/payload/src/uploads/types.ts

@@ -173,7 +173,12 @@ export type UploadConfig = {
    */
   displayPreview?: boolean
   /**
-   * Ability to filter/modify Request Headers when fetching a file.
+   *
+   * Accepts existing headers and returns the headers after filtering or modifying.
+   * If using this option, you should handle the removal of any sensitive cookies
+   * (like payload-prefixed cookies) to prevent leaking session information to external
+   * services. By default, Payload automatically filters out payload-prefixed cookies
+   * when this option is NOT defined.
    *
    * Useful for adding custom headers to fetch from external providers.
    * @default undefined

test/uploads/config.ts

@@ -39,6 +39,7 @@ import {
   relationSlug,
   restrictFileTypesSlug,
   skipAllowListSafeFetchMediaSlug,
+  skipSafeFetchHeaderFilterSlug,
   skipSafeFetchMediaSlug,
   svgOnlySlug,
   threeDimensionalSlug,
@@ -465,6 +466,15 @@ export default buildConfigWithDefaults({
         staticDir: path.resolve(dirname, './media'),
       },
     },
+    {
+      slug: skipSafeFetchHeaderFilterSlug,
+      fields: [],
+      upload: {
+        skipSafeFetch: true,
+        staticDir: path.resolve(dirname, './media'),
+        externalFileHeaderFilter: (headers) => headers, // Keep all headers including cookies
+      },
+    },
     {
       slug: skipAllowListSafeFetchMediaSlug,
       fields: [],

test/uploads/int.spec.ts

@@ -24,6 +24,7 @@ import {
   relationSlug,
   restrictFileTypesSlug,
   skipAllowListSafeFetchMediaSlug,
+  skipSafeFetchHeaderFilterSlug,
   skipSafeFetchMediaSlug,
   svgOnlySlug,
   unstoredMediaSlug,
@@ -567,6 +568,68 @@ describe('Collections - Uploads', () => {
       })
     })
 
+    describe('cookie filtering', () => {
+      it('should filter out payload cookies when externalFileHeaderFilter is not defined', async () => {
+        const testCookies = ['payload-token=123', 'other-cookie=456', 'payload-something=789'].join(
+          '; ',
+        )
+
+        const fetchSpy = jest.spyOn(global, 'fetch')
+
+        await payload.create({
+          collection: skipSafeFetchMediaSlug,
+          data: {
+            filename: 'fat-head-nate.png',
+            url: 'https://www.payload.marketing/fat-head-nate.png',
+          },
+          req: {
+            headers: new Headers({
+              cookie: testCookies,
+            }),
+          },
+        })
+
+        const [[, options]] = fetchSpy.mock.calls
+        const cookieHeader = options.headers.cookie
+
+        expect(cookieHeader).not.toContain('payload-token=123')
+        expect(cookieHeader).not.toContain('payload-something=789')
+        expect(cookieHeader).toContain('other-cookie=456')
+
+        fetchSpy.mockRestore()
+      })
+
+      it('should keep all cookies when externalFileHeaderFilter is defined', async () => {
+        const testCookies = ['payload-token=123', 'other-cookie=456', 'payload-something=789'].join(
+          '; ',
+        )
+
+        const fetchSpy = jest.spyOn(global, 'fetch')
+
+        await payload.create({
+          collection: skipSafeFetchHeaderFilterSlug,
+          data: {
+            filename: 'fat-head-nate.png',
+            url: 'https://www.payload.marketing/fat-head-nate.png',
+          },
+          req: {
+            headers: new Headers({
+              cookie: testCookies,
+            }),
+          },
+        })
+
+        const [[, options]] = fetchSpy.mock.calls
+        const cookieHeader = options.headers.cookie
+
+        expect(cookieHeader).toContain('other-cookie=456')
+        expect(cookieHeader).toContain('payload-token=123')
+        expect(cookieHeader).toContain('payload-something=789')
+
+        fetchSpy.mockRestore()
+      })
+    })
+
     describe('filters', () => {
       it.each`
         url                                  | collection            | errorContains

test/uploads/payload-types.ts

@@ -83,6 +83,7 @@ export interface Config {
     media: Media;
     'allow-list-media': AllowListMedia;
     'skip-safe-fetch-media': SkipSafeFetchMedia;
+    'skip-safe-fetch-header-filter': SkipSafeFetchHeaderFilter;
     'skip-allow-list-safe-fetch-media': SkipAllowListSafeFetchMedia;
     'restrict-file-types': RestrictFileType;
     'no-restrict-file-types': NoRestrictFileType;
@@ -141,6 +142,7 @@ export interface Config {
     media: MediaSelect<false> | MediaSelect<true>;
     'allow-list-media': AllowListMediaSelect<false> | AllowListMediaSelect<true>;
     'skip-safe-fetch-media': SkipSafeFetchMediaSelect<false> | SkipSafeFetchMediaSelect<true>;
+    'skip-safe-fetch-header-filter': SkipSafeFetchHeaderFilterSelect<false> | SkipSafeFetchHeaderFilterSelect<true>;
     'skip-allow-list-safe-fetch-media': SkipAllowListSafeFetchMediaSelect<false> | SkipAllowListSafeFetchMediaSelect<true>;
     'restrict-file-types': RestrictFileTypesSelect<false> | RestrictFileTypesSelect<true>;
     'no-restrict-file-types': NoRestrictFileTypesSelect<false> | NoRestrictFileTypesSelect<true>;
@@ -830,6 +832,24 @@ export interface SkipSafeFetchMedia {
   focalX?: number | null;
   focalY?: number | null;
 }
+/**
+ * This interface was referenced by `Config`'s JSON-Schema
+ * via the `definition` "skip-safe-fetch-header-filter".
+ */
+export interface SkipSafeFetchHeaderFilter {
+  id: string;
+  updatedAt: string;
+  createdAt: string;
+  url?: string | null;
+  thumbnailURL?: string | null;
+  filename?: string | null;
+  mimeType?: string | null;
+  filesize?: number | null;
+  width?: number | null;
+  height?: number | null;
+  focalX?: number | null;
+  focalY?: number | null;
+}
 /**
  * This interface was referenced by `Config`'s JSON-Schema
  * via the `definition` "skip-allow-list-safe-fetch-media".
@@ -1698,6 +1718,10 @@ export interface PayloadLockedDocument {
         relationTo: 'skip-safe-fetch-media';
         value: string | SkipSafeFetchMedia;
       } | null)
+    | ({
+        relationTo: 'skip-safe-fetch-header-filter';
+        value: string | SkipSafeFetchHeaderFilter;
+      } | null)
     | ({
         relationTo: 'skip-allow-list-safe-fetch-media';
         value: string | SkipAllowListSafeFetchMedia;
@@ -2533,6 +2557,23 @@ export interface SkipSafeFetchMediaSelect<T extends boolean = true> {
   focalX?: T;
   focalY?: T;
 }
+/**
+ * This interface was referenced by `Config`'s JSON-Schema
+ * via the `definition` "skip-safe-fetch-header-filter_select".
+ */
+export interface SkipSafeFetchHeaderFilterSelect<T extends boolean = true> {
+  updatedAt?: T;
+  createdAt?: T;
+  url?: T;
+  thumbnailURL?: T;
+  filename?: T;
+  mimeType?: T;
+  filesize?: T;
+  width?: T;
+  height?: T;
+  focalX?: T;
+  focalY?: T;
+}
 /**
  * This interface was referenced by `Config`'s JSON-Schema
  * via the `definition` "skip-allow-list-safe-fetch-media_select".
@@ -3409,6 +3450,6 @@ export interface Auth {
 
 
 declare module 'payload' {
-  // @ts-ignore 
+  // @ts-ignore
   export interface GeneratedTypes extends Config {}
-}
+}

test/uploads/shared.ts

@@ -30,6 +30,7 @@ export const restrictFileTypesSlug = 'restrict-file-types'
 export const noRestrictFileTypesSlug = 'no-restrict-file-types'
 export const noRestrictFileMimeTypesSlug = 'no-restrict-file-mime-types'
 export const skipSafeFetchMediaSlug = 'skip-safe-fetch-media'
+export const skipSafeFetchHeaderFilterSlug = 'skip-safe-fetch-header-filter'
 export const skipAllowListSafeFetchMediaSlug = 'skip-allow-list-safe-fetch-media'
 export const listViewPreviewSlug = 'list-view-preview'
 export const threeDimensionalSlug = 'three-dimensional'