anomalyco / anomalyco/opencode
[Bug]: proxy forwards headers named by Connection
@rekram1-node is already working on this.
Since Sep 7, 2026.
- Dominant language
- TypeScript
- Stars
- 209k
- Forks
- 27.5k
- PR merge metrics
- PR metrics pending
Description
Description
ProxyUtil.headers() removes the fixed hop-by-hop header set, but it leaves extension headers named by the incoming Connection header.
For example, with Connection: x-hop, the Connection header is removed while X-Hop: must-not-forward is still sent upstream. RFC 9110 §7.6.1 requires an intermediary to remove every field named by Connection before forwarding. Both HTTP proxy call sites use this helper.
Steps to reproduce
-
From
packages/opencode, run:bun -e 'import { ProxyUtil } from "./src/server/proxy-util.ts"; console.log(Object.fromEntries(ProxyUtil.headers({ connection: "x-hop", "x-hop": "must-not-forward", "x-end": "keep" })))' -
Observe that the result still contains
x-hop:{ "x-end": "keep", "x-hop": "must-not-forward" }
Expected: connection and x-hop are absent, while x-end remains.
Operating System
All platforms
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.