Skip to content

fix(server): strip hop-by-hop proxy headers #408

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Gujiassh wants to merge 2 commits into
base: main
Choose a base branch
from
Open

fix(server): strip hop-by-hop proxy headers #408

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2be9dc2
fix(server): filter hop-by-hop proxy headers
Gujiassh Mar 10, 2026
9d50fe4
fix(server): honor Connection hop-by-hop headers
Gujiassh Mar 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 24 additions & 2 deletions server/src/api/lifecycle.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -440,12 +440,20 @@ async def proxy_sandbox_endpoint_request(request: Request, sandbox_id: str, port

try:
# Filter headers
hop_by_hop = set(HOP_BY_HOP_HEADERS)
connection_header = request.headers.get("connection")
if connection_header:
hop_by_hop.update(
header.strip().lower()
for header in connection_header.split(",")
if header.strip()
)
headers = {}
for key, value in request.headers.items():
key_lower = key.lower()
if (
key_lower != "host"
and key_lower not in HOP_BY_HOP_HEADERS
and key_lower not in hop_by_hop
and key_lower not in SENSITIVE_HEADERS
):
headers[key] = value
Expand All @@ -466,10 +474,24 @@ async def proxy_sandbox_endpoint_request(request: Request, sandbox_id: str, port

resp = await client.send(req, stream=True)

hop_by_hop = set(HOP_BY_HOP_HEADERS)
connection_header = resp.headers.get("connection")
if connection_header:
hop_by_hop.update(
header.strip().lower()
for header in connection_header.split(",")
if header.strip()
)
response_headers = {
key: value
for key, value in resp.headers.items()
if key.lower() not in hop_by_hop
}

return StreamingResponse(
content=resp.aiter_bytes(),
status_code=resp.status_code,
headers=resp.headers,
headers=response_headers,
)
except httpx.ConnectError as e:
raise HTTPException(
Expand Down