Skip to content

bugfix: ignore enumerable functions when copying headers in Pages-router #2225

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 24 additions & 6 deletions src/server/client.ts
Original file line number Diff line number Diff line change
Expand Up @@ -682,17 +682,35 @@ export class Auth0Client {
}
}

/**
* createRequestCookies copies the incoming request's headers to a WHATWG
* `Headers` instance while ensuring we only include *actual* header values.
*
* In Node ≥ 20 the `req.headers` object is a proxy that also enumerates
* helper methods such as `append`, `delete`, `get`, etc. Copying these
* function properties verbatim will cause the WHATWG `Headers` constructor
* to throw `TypeError: <fn> is an invalid header value`.
*
* We therefore iterate over `Object.entries(req.headers)` and copy only
* string or string[] values. This maintains backwards compatibility while
* fixing the runtime error reported in #2219.
*/
private createRequestCookies(req: PagesRouterRequest) {
const headers = new Headers();

for (const key in req.headers) {
if (Array.isArray(req.headers[key])) {
for (const value of req.headers[key]) {
headers.append(key, value);
for (const [key, val] of Object.entries(req.headers)) {
if (val == null) {
continue; // skip undefined/null
}

if (Array.isArray(val)) {
for (const v of val) {
headers.append(key, v);
}
} else {
headers.append(key, req.headers[key] ?? "");
} else if (typeof val === "string") {
headers.append(key, val);
}
// ignore functions or other non-string values
}

return new RequestCookies(headers);
Expand Down
63 changes: 63 additions & 0 deletions src/server/createRequestCookies-header-copy.test.ts
Original file line number Diff line number Diff line change
@@ -0,0 +1,63 @@
import type { IncomingMessage } from "node:http";
import { describe, expect, it } from "vitest";

import { Auth0Client } from "./client.js";

/**
* Regression tests for https://github.com/auth0/nextjs-auth0/issues/2219
* – "Headers.append: <fn> is an invalid header value".
*/

describe("#2219 – createRequestCookies header copying", () => {
/**
* Factory that creates an Auth0Client instance with minimal (fake) config
* sufficient for creating the class without throwing configuration errors.
*/
function makeClient() {
return new Auth0Client({
domain: "example.auth0.com",
clientId: "client_id",
clientSecret: "client_secret",
secret: "0123456789abcdef0123456789abcdef",
appBaseUrl: "http://localhost:3000"
});
}

/**
* Creates a bare-bones object that satisfies the subset of `IncomingMessage`
* the private `createRequestCookies()` helper expects: a `headers` record.
*/
function makePagesRouterReq(headers: Record<string, any>): IncomingMessage {
return { headers } as unknown as IncomingMessage;
}

it("ignores function properties on req.headers (no throw)", () => {
const client: any = makeClient();

const req = makePagesRouterReq({
cookie: "foo=bar",
foo: "bar",
append: () => {} // bogus enumerable function property that caused the crash
});

expect(() => client.createRequestCookies(req)).not.toThrow();
});

it("copies string and string[] values correctly", () => {
const client: any = makeClient();

const req = makePagesRouterReq({
cookie: "foo=bar",
"set-cookie": ["a=1", "b=2"]
});

const cookies = client.createRequestCookies(req);

// Should parse the cookie header
const foo = cookies.get("foo");
expect(foo?.value).toBe("bar");

// Still exposes at least one cookie object
expect(cookies.getAll().length).toBeGreaterThanOrEqual(1);
});
});