Filter proxied headers

server/http_server.ts

@@ -469,9 +469,18 @@ export class HttpServer {
         url = `https://${url}`;
       }
       try {
+        const safeRequestHeaders = new Headers();
+        for (const headerName of ["Authorization", "Accept", "Content-Type"]) {
+          if (request.headers.has(headerName)) {
+            safeRequestHeaders.set(
+              headerName,
+              request.headers.get(headerName)!,
+            );
+          }
+        }
         const req = await fetch(url, {
           method: request.method,
-          headers: request.headers,
+          headers: safeRequestHeaders,
           body: request.hasBody
             ? request.body({ type: "stream" }).value
             : undefined,
@@ -521,3 +530,10 @@ function utcDateString(mtime: number): string {
 function authCookieName(host: string) {
   return `auth:${host}`;
 }
+
+function copyHeader(fromHeaders: Headers, toHeaders: Headers, header: string) {
+  const value = fromHeaders.get(header);
+  if (value) {
+    toHeaders.set(header, value);
+  }
+}

web/service_worker.ts

@@ -156,7 +156,11 @@ async function handleLocalFileRequest(
       url = `https://${url}`;
     }
     console.info("Proxying federated URL", path, "to", url);
-    return fetch(url, { method: "GET", headers: request.headers });
+    return fetch(url, {
+      method: request.method,
+      headers: request.headers,
+      body: request.body,
+    });
   } else {
     console.error(
       "Did not find file in locally synced space",