@uppy/companion/lib/server/header-blacklist.js

OAuth helper and remote fetcher for Uppy's (https://uppy.io) extensible file upload widget with support for drag&drop, resumable uploads, previews, restrictions, file processing/encoding, remote providers like Dropbox and Google Drive, S3 and more :dog:

import * as logger from './logger.js';
/**
 * Forbidden header names.
 */
const forbiddenNames = [
    'accept-charset',
    'accept-encoding',
    'access-control-request-headers',
    'access-control-request-method',
    'connection',
    'content-length',
    'cookie',
    'cookie2',
    'date',
    'dnt',
    'expect',
    'host',
    'keep-alive',
    'origin',
    'referer',
    'te',
    'trailer',
    'transfer-encoding',
    'upgrade',
    'via',
];
/**
 * Forbidden header regexs.
 */
const forbiddenRegex = [/^proxy-.*$/, /^sec-.*$/];
/**
 * Check if the header in parameter is a forbidden header.
 *
 * @param {string} header Header to check
 * @returns True if header is forbidden, false otherwise.
 */
const isForbiddenHeader = (header) => {
    const headerLower = header.toLowerCase();
    const forbidden = forbiddenNames.indexOf(headerLower) >= 0 ||
        forbiddenRegex.findIndex((regex) => regex.test(headerLower)) >= 0;
    if (forbidden) {
        logger.warn(`Header forbidden: ${header}`, 'header.forbidden');
    }
    return forbidden;
};
export default function headerBlacklist(headers) {
    if (headers == null ||
        typeof headers !== 'object' ||
        Array.isArray(headers)) {
        return {};
    }
    const headersCloned = { ...headers };
    Object.keys(headersCloned).forEach((header) => {
        if (isForbiddenHeader(header)) {
            delete headersCloned[header];
        }
    });
    return headersCloned;
}