hasura / hasura/graphql-engine

Same name action request headers don't work properly

Open
#10,132 0 comments 0 reactions 0 assignees View on GitHub
k/bug
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

### Version Information

Server Version: v2.37.0-cloud.1

### Environment

Cloud

### What is the current behaviour?

I have 2 env vars called X and Y with different hostnames (URLs) as values.
Having this configuration set up for a Hasura action (on the screenshot below) and sending the Origin header with a Y value Hasura replaces it with an X value.
When I switch the order of the X and Y I get the correct value, but then when I send the header with X value I get the wrong value in my app again. Seems like whatever is at the top for the same name header takes precedence.

### What is the expected behaviour?

Hasura allows 2 values of the `Origin` header and passes the same header to the server that was sent by the client.

### How to reproduce the issue?

1. Define a mutation Hasura action, it could be whatever just set the headers as on the screenshot (You can even skip the `From env var` option and just use the `Value` remember they have to be different.
2. Set the webhook handler (f.e. you can use https://webhook.site/)
3. Call Hasura action with two different `Origin` headers that you set up
4. Check the `Origin` headers that were passed on your unique https://webhook.site/ link

### Screenshots or Screencast

![image](https://github.com/hasura/graphql-engine/assets/41804626/d7a9b75b-d2fa-4686-99a2-bd5155092796)
![image](https://github.com/hasura/graphql-engine/assets/41804626/29f7df69-5133-405c-912e-6574e9b9da12)

### Any possible solutions/workarounds you're aware of?

None

### Keywords

headers, same name headers

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the issue with a Hasura action configured with two different Origin header values and a webhook.site handler, then inspect the action request-header handling entry point. Done means each client-sent Origin value is forwarded to the webhook without one same-name configuration taking precedence over the other.

Written by the indexing model from the issue text.

Assessment

Tech stack
graphql
Domain
api
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.