diff --git a/lib/handler/redirect-handler.js b/lib/handler/redirect-handler.js index 151cbe2f966..b79c9441c31 100644 --- a/lib/handler/redirect-handler.js +++ b/lib/handler/redirect-handler.js @@ -227,9 +227,10 @@ function cleanRequestHeaders (headers, removeContent, unknownOrigin) { } } } else if (headers && typeof headers === 'object') { - for (const key of Object.keys(headers)) { + const entries = headers instanceof Headers ? headers.entries() : Object.entries(headers) + for (const [key, value] of entries) { if (!shouldRemoveHeader(key, removeContent, unknownOrigin)) { - ret.push(key, headers[key]) + ret.push(key, value) } } } else { diff --git a/test/redirect-request.js b/test/redirect-request.js index c7264bc5faf..50c8931a5f1 100644 --- a/test/redirect-request.js +++ b/test/redirect-request.js @@ -227,6 +227,34 @@ for (const factory of [ await t.completed }) + test('should remove Host and request body related headers when following HTTP 303 (Headers)', async t => { + t = tspl(t, { plan: 3 }) + + const server = await startRedirectingServer() + + const { statusCode, headers, body: bodyStream } = await request(t, server, undefined, `http://${server}/303`, { + method: 'PATCH', + headers: new Headers({ + 'Content-Encoding': 'gzip', + 'X-Foo1': '1', + 'X-Foo2': '2', + 'Content-Type': 'application/json', + 'X-Foo3': '3', + Host: 'localhost', + 'X-Bar': '4' + }), + maxRedirections: 10 + }) + + const body = await bodyStream.text() + + t.strictEqual(statusCode, 200) + t.ok(!headers.location) + t.strictEqual(body, `GET /5 :: host@${server} connection@keep-alive x-bar@4 x-foo1@1 x-foo2@2 x-foo3@3`) + + await t.completed + }) + test('should follow redirection after a HTTP 307', async t => { t = tspl(t, { plan: 3 })