@uppy/companion/src/server/header-blacklist.js

OAuth helper and remote fetcher for Uppy's (https://uppy.io) extensible file upload widget with support for drag&drop, resumable uploads, previews, restrictions, file processing/encoding, remote providers like Dropbox and Google Drive, S3 and more :dog:

import * as logger from './logger.js'

/**
 * Forbidden header names.
 */
const forbiddenNames = [
  'accept-charset',
  'accept-encoding',
  'access-control-request-headers',
  'access-control-request-method',
  'connection',
  'content-length',
  'cookie',
  'cookie2',
  'date',
  'dnt',
  'expect',
  'host',
  'keep-alive',
  'origin',
  'referer',
  'te',
  'trailer',
  'transfer-encoding',
  'upgrade',
  'via',
]

/**
 * Forbidden header regexs.
 */
const forbiddenRegex = [/^proxy-.*$/, /^sec-.*$/]

/**
 * Check if the header in parameter is a forbidden header.
 *
 * @param {string} header Header to check
 * @returns True if header is forbidden, false otherwise.
 */
const isForbiddenHeader = (header) => {
  const headerLower = header.toLowerCase()
  const forbidden =
    forbiddenNames.indexOf(headerLower) >= 0 ||
    forbiddenRegex.findIndex((regex) => regex.test(headerLower)) >= 0

  if (forbidden) {
    logger.warn(`Header forbidden: ${header}`, 'header.forbidden')
  }
  return forbidden
}

export default function headerBlacklist(headers) {
  if (
    headers == null ||
    typeof headers !== 'object' ||
    Array.isArray(headers)
  ) {
    return {}
  }

  const headersCloned = { ...headers }
  Object.keys(headersCloned).forEach((header) => {
    if (isForbiddenHeader(header)) {
      delete headersCloned[header]
    }
  })
  return headersCloned
}