lablup / lablup/backend.ai

Support headers override in `Request.fetch()` to enable `Date` header–based signature auth with proxy

Open
#5,737 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
670
Forks
183
Avg merge
17h 7m
Merged PRs (30d)
358

Description

## Motivation

[http://Backend.AI](http://Backend.AI) ’s authentication signature depends on the `Date` HTTP header:
[https://github.com/lablup/backend.ai/blob/f2afa387deea7bcb42d8f322ec4faf426f7ab626/src/ai/backend/common/auth/utils.py#L32](https://github.com/lablup/backend.ai/blob/f2afa387deea7bcb42d8f322ec4faf426f7ab626/src/ai/backend/common/auth/utils.py#L32)

However, when using **Webserver as a proxy**, it is currently impossible to forward the client’s original `Date` header to the upstream server, because the `Request.fetch()` method **always refreshes and overrides the** `Date` **header** as part of its internal behavior:

- Proxy refresh logic:
[https://github.com/lablup/backend.ai/blob/f2afa387deea7bcb42d8f322ec4faf426f7ab626/src/ai/backend/web/proxy.py#L235](https://github.com/lablup/backend.ai/blob/f2afa387deea7bcb42d8f322ec4faf426f7ab626/src/ai/backend/web/proxy.py?utm_source=chatgpt.com#L235)
- Request behavior:
[https://github.com/lablup/backend.ai/blob/f2afa387deea7bcb42d8f322ec4faf426f7ab626/src/ai/backend/client/request.py#L320](https://github.com/lablup/backend.ai/blob/f2afa387deea7bcb42d8f322ec4faf426f7ab626/src/ai/backend/client/request.py?utm_source=chatgpt.com#L320)

This prevents implementations that rely on `Date`-header–based signature authentication from functioning correctly behind a proxy.

## Required Features

Extend `Request.fetch()` to support **explicit header overrides**, so that the caller can force specific values (e.g., `Date`) to be used instead of the internally refreshed ones.

**Example usage:**

```python
request.fetch(
headers={
"Date": "Tue, 02 Sep 2025 08:00:00 GMT",
}
)
```

## Impact

This would ensure that the provided `Date` header is preserved and passed through, enabling signature-based authentication behind proxies.

## Testing Scenarios

-

JIRA Issue: BA-2257

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.