dherault / dherault/serverless-offline

API Gateway emulation doesn't remap headers like actual API Gateway

Open
#1,062 4 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
JavaScript
Stars
5.3k
Forks
811
Avg merge
2d 4h
Merged PRs (30d)
3

Description

## Bug Report
[API Gateway has a known issue](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-known-issues.html) where request headers get remapped in a **case-sensitive** way, whereas the HTTP specification notes that headers are case-insensitive. See:
Screen Shot 2020-08-12 at 1 32 15 PM

My team discovered this issue when testing our GraphQL API against a deployed instance versus a local instance. In the local instance, we passed the header "authorization" and discovered some code paths relying on the case sensitive naming stopped working locally. However, on the deployed instance, we saw the same header work without fail. We discovered the documentation linked above and found that API Gateway does header remapping which this library does not currently support so the emulation is incorrect.

**Current Behavior**
* Headers are just passed through as provided by the instance

**Expected behavior/code**
* Headers are remapped to emulate the AWS API Gateway behavior.

**Environment**
- `serverless` version: v1.78.1
- `serverless-offline` version: v6.5.0
- `node.js` version: v12.16.2
- `OS`: macOS 10.15.5

**Possible Solution**
Remap request headers to emulate the behaviors provided by the API Gateway documentation:
| Header name | Request (http/http_proxy/lambda) | Response (http/http_proxy/lambda) |
|--------------------|---------------------------------------|-----------------------------------|
| Age | Passthrough | Passthrough |
| Accept | Passthrough | Dropped/Passthrough/Passthrough |
| Accept-Charset | Passthrough | Passthrough |
| Accept-Encoding | Passthrough | Passthrough |
| Authorization | Passthrough | Remapped |
| Connection | Passthrough/Passthrough/Dropped | Remapped |
| Content-Encoding | Passthrough/Dropped/Passthrough | Passthrough |
| Content-Length | Passthrough (generated based on body) | Passthrough |
| Content-MD5 | Dropped | Remapped |
| Content-Type | Passthrough | Passthrough |
| Date | Passthrough | Remapped Overwritten |
| Expect | Dropped | Dropped |
| Host | 5XX/5XX/Overwritten by Lambda | Dropped |
| Max-Forwards | Dropped | Remapped |
| Pragma | Passthrough | Passthrough |
| Proxy-Authenticate | Dropped | Dropped |
| Range | Passthrough | Passthrough |
| Referer | Passthrough | Passthrough |
| Server | Dropped | Remapped Overwritten |
| TE | Dropped | Dropped |
| Transfer-Encoding | Dropped/Dropped/Exception | Dropped |
| Trailer | Dropped | Dropped |
| Upgrade | Dropped | Dropped |
| User-Agent | Passthrough | Remapped |
| Via | Dropped/Dropped/Passthrough | Passthrough/Dropped/Dropped |
| Warn | Passthrough | Passthrough |
| WWW-Authenticate | Dropped | Remapped |

Contributor guide

Open the contributing guide

Research direction

The issue does not name implementation files, tests, or an entry point. Start by locating the API Gateway request and response header handling, then compare its behavior with the linked AWS header-remapping table; done means the local emulation matches the documented deployed behavior for the listed headers.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, javascript, node.js
Domain
api, backend, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.