search

improbable-eng / grpc-web

gRPC Web implementation for Golang and TypeScript
Apache License 2.0
4.39k stars 436 forks source link

grpcwebproxy `--allowed_headers` param is case-sensitive for WebSocket #1175

Open dartkron opened 1 year ago

dartkron commented 1 year ago

Versions of relevant software used grpcwebproxy-v0.15.0

What happened We use WebSocket to connect browser-clients with bi-directional streaming and noticed that although some headers are listed in --allowed_headers, they were not forwarded to the server. For example, we used to run grpcwebproxy with --allowed_headers=x-forwarded-for , but header X-Forwarded-For wasn't forwarded.

We debugged it and found that grpcwebproxy filters WebSocket headers as case-sensitive.

To confirm the issue, we've ran grpcwebproxy with --allowed_headers=x-forwarded-for,X-Forwarded-For and it started to work.

What you expected to happen We would expect that grpcwebproxy will follow the RFC:

Each header field consists of a name followed by a colon (":") and the field value. Field names are case-insensitive.

Moreover, for regular HTTP headers are handled as case-insensitive: 1 -> 2 -> 3, so we would expect a consistent behavior across all protocols.

How to reproduce it (as minimally and precisely as possible):

  1. Run a simple GRPC server which print all received headers.
  2. Run grpcwebproxy which proxies requests to the server started above with --use_websockets and --allowed_headers=header_name.
  3. Connect a WebSocket client which sends header Header_Name.
  4. Verify that the header wasn't received by the server.
  5. Restart grpcwebproxy with --allowed_headers=Header_Name.
  6. Re-connect client and verify that the header has been received a this time.

Anything else we need to know Please acknowledge the issue and we would be happy to fix it.