Closed damianijr closed 6 years ago
We should make sure that this can't be used to bypass browser restrictions on headers. There is a list here of headers that can't be set using browser XMLHttpRequest: https://fetch.spec.whatwg.org/#forbidden-header-name
Any of that list + anything starting with Proxy- or Sec- should be removed from the headers
object before we use it
tks @goto-bus-stop, I will implement this header blacklist and push soon.
@goto-bus-stop @ifedapoolarewaju new PR available. Let mw know about changes or improves. tks
thank you for the PR
The purpose of this PR is make uppy-server be able to pass request headers configured in uppy XHR to upload endpoint.
There are a lot of use cases that need of this feature (authorizations, refer, and so on..).
Nowadays, the headers already are sended to providers endpoints but is not passed to upload endpoint.
This discussion was started in uppy project, follow the link: https://github.com/transloadit/uppy/issues/779