Lucas WintherandClaude Opus 5.5
213f2247b4
spaWithCsp proxies GET and HEAD only (405 otherwise, no body buffering) and forwards only accept, if-none-match, if-modified-since and range. The internal server listens on a Unix socket in a private 0700 temp dir. Bun 1.3.14 ignores proxy: false for this hop, and over a socket with a proxy set it sends an absolute-form target that breaks asset routing, so localhost, 127.0.0.1 and ::1 are appended to NO_PROXY/no_proxy (existing entries kept). accept-encoding is no longer forced; fetch decompresses and the encoding headers are dropped. Test: in a subprocess with HTTP(S)_PROXY and ALL_PROXY set to a dead proxy, the SPA and an asset load with the CSP, POST gets 405, and the upstream sees no Cookie, Authorization or X-Forwarded-For. Co-Authored-By: Claude Opus 5.5 <[email protected]>
78 lines
4.0 KiB
TypeScript
78 lines
4.0 KiB
TypeScript
// Run by spa.test.ts in a subprocess with HTTP_PROXY/ALL_PROXY pointing at an unreachable proxy.
|
|
import { spaWithCsp } from "../../src/server/spa";
|
|
|
|
/**
|
|
* The test client speaks raw HTTP/1.1 over Bun.connect: fetch and Bun's node:http both honour HTTP_PROXY, and
|
|
* only the code under test should meet the proxy.
|
|
*/
|
|
async function get(url: string, method = "GET", headers: Record<string, string> = {}): Promise<{ status: number; headers: Record<string, string>; body: string }> {
|
|
const u = new URL(url);
|
|
let raw = "";
|
|
await new Promise<void>((resolve, reject) => {
|
|
Bun.connect({
|
|
hostname: u.hostname, port: Number(u.port),
|
|
socket: {
|
|
open(sock) {
|
|
const body = method === "POST" ? "x" : "";
|
|
const lines = [`${method} ${u.pathname}${u.search} HTTP/1.1`, `Host: ${u.host}`, "Connection: close", ...Object.entries(headers).map(([k, v]) => `${k}: ${v}`)];
|
|
if (body) lines.push(`Content-Length: ${body.length}`);
|
|
sock.write(`${lines.join("\r\n")}\r\n\r\n${body}`);
|
|
},
|
|
data(sock, d) {
|
|
raw += new TextDecoder().decode(d);
|
|
// Bun keeps the connection open despite "Connection: close"; stop once the whole response is here.
|
|
const end = raw.indexOf("\r\n\r\n");
|
|
if (end < 0) return;
|
|
const len = /\r\ncontent-length:\s*(\d+)/i.exec(raw.slice(0, end));
|
|
const done = len ? raw.length - end - 4 >= Number(len[1]) : /\r\n0\r\n\r\n$/.test(raw);
|
|
if (done) { sock.end(); resolve(); }
|
|
},
|
|
close() { resolve(); },
|
|
error(_s, e) { reject(e); },
|
|
},
|
|
}).catch(reject);
|
|
});
|
|
const [head, ...rest] = raw.split("\r\n\r\n");
|
|
const [statusLine, ...hl] = head!.split("\r\n");
|
|
const hs = Object.fromEntries(hl.map((l) => [l.slice(0, l.indexOf(":")).toLowerCase(), l.slice(l.indexOf(":") + 1).trim()]));
|
|
let body = rest.join("\r\n\r\n");
|
|
if (hs["transfer-encoding"] === "chunked") {
|
|
let out = "", i = 0;
|
|
for (;;) { const nl = body.indexOf("\r\n", i); const n = parseInt(body.slice(i, nl), 16); if (!n) break; out += body.slice(nl + 2, nl + 2 + n); i = nl + 2 + n + 2; }
|
|
body = out;
|
|
}
|
|
return { status: Number(statusLine!.split(" ")[1]), headers: hs, body };
|
|
}
|
|
|
|
// Control, before spaWithCsp touches NO_PROXY: a plain loopback fetch in this process goes to the env proxy.
|
|
const plain = Bun.serve({ hostname: "127.0.0.1", port: 0, fetch: () => new Response("direct") });
|
|
const controlViaEnvProxy = await fetch(`http://127.0.0.1:${plain.port}/`, { signal: AbortSignal.timeout(2000) }).then((r) => `status ${r.status}`, (e) => `error ${(e as Error).name}`);
|
|
plain.stop(true);
|
|
|
|
const seen: Record<string, string | null>[] = [];
|
|
const DOC = '<!doctype html><html><head><script type="module" src="/app.js"></script></head><body><div id="root"></div></body></html>';
|
|
const spa = spaWithCsp((req) => {
|
|
if (new URL(req.url).pathname === "/app.js") return new Response("console.log(1)", { headers: { "Content-Type": "text/javascript" } });
|
|
seen.push({ cookie: req.headers.get("cookie"), authorization: req.headers.get("authorization"), xff: req.headers.get("x-forwarded-for"), accept: req.headers.get("accept") });
|
|
return new Response(DOC, { headers: { "Content-Type": "text/html;charset=utf-8" } });
|
|
}, { development: false });
|
|
const server = Bun.serve({ hostname: "127.0.0.1", port: 0, routes: spa.routes });
|
|
const url = `http://127.0.0.1:${server.port}/c/sample`;
|
|
const out: Record<string, unknown> = {};
|
|
try {
|
|
out.controlViaEnvProxy = controlViaEnvProxy;
|
|
const r = await get(url, "GET", { cookie: "better-auth.session_token=secret", authorization: "Bearer secret", "x-forwarded-for": "1.2.3.4", accept: "text/html" });
|
|
out.status = r.status;
|
|
out.csp = r.headers["content-security-policy"];
|
|
out.body = r.body;
|
|
out.post = (await get(url, "POST")).status;
|
|
const asset = await get(`http://127.0.0.1:${server.port}/app.js`);
|
|
out.asset = `${asset.status} ${asset.headers["content-type"]} ${asset.body}`;
|
|
out.noProxy = process.env.NO_PROXY;
|
|
out.seen = seen;
|
|
} finally {
|
|
server.stop(true);
|
|
spa.stop();
|
|
}
|
|
console.log(JSON.stringify(out));
|