fix: now WAF bypass token header is forwarded

src/index.ts

@@ -4,8 +4,12 @@ import { createIPX, handleRequest, IPXOptions } from 'ipx'
 import { builder, Handler } from '@netlify/functions'
 import { parseURL } from 'ufo'
 import etag from 'etag'
-import { loadSourceImage } from './http'
+import { loadSourceImage as defaultLoadSourceImage } from './http'
 import { decodeBase64Params, doPatternsMatchUrl, RemotePattern } from './utils'
+
+// WAF is Web Application Firewall
+const WAF_BYPASS_TOKEN_HEADER = 'X-Nf-Waf-Bypass-Token'
+
 export interface IPXHandlerOptions extends Partial<IPXOptions> {
   /**
    * Path to cache directory
@@ -51,7 +55,7 @@ export function createIPXHandler ({
   responseHeaders,
   localPrefix,
   ...opts
-}: IPXHandlerOptions = {}) {
+}: IPXHandlerOptions = {}, loadSourceImage = defaultLoadSourceImage) {
   const ipx = createIPX({ ...opts, dir: join(cacheDir, 'cache') })
   if (!basePath.endsWith('/')) {
     basePath = `${basePath}/`
@@ -94,8 +98,18 @@ export function createIPXHandler ({
     const requestHeaders: Record<string, string> = {
       [SUBREQUEST_HEADER]: '1'
     }
+
     const isLocal = !id.startsWith('http://') && !id.startsWith('https://')
     if (isLocal) {
+      // This header is available to all lambdas that went through WAF
+      // We need to add it for local images (origin server) to be able to bypass WAF
+      if (event.headers[WAF_BYPASS_TOKEN_HEADER]) {
+        // eslint-disable-next-line no-console
+        console.log(`WAF bypass token found, setting ${WAF_BYPASS_TOKEN_HEADER} header to load source image`)
+        requestHeaders[WAF_BYPASS_TOKEN_HEADER] =
+          event.headers[WAF_BYPASS_TOKEN_HEADER]
+      }
+
       const url = new URL(event.rawUrl)
       url.pathname = id
       if (localPrefix && !url.pathname.startsWith(localPrefix)) {

test/index.test.ts

@@ -5,7 +5,24 @@ import test from 'ava'
 import { readFile, statSync, emptyDir, readdirSync } from 'fs-extra'
 
 import { createIPXHandler } from '../src/index'
-import { CACHE_PRUNING_THRESHOLD } from '../src/http'
+import { CACHE_PRUNING_THRESHOLD, SourceImageResult } from '../src/http'
+
+function getHandlerContext () {
+  return {
+    functionName: 'ipx',
+    callbackWaitsForEmptyEventLoop: false,
+    functionVersion: '1',
+    invokedFunctionArn: '',
+    awsRequestId: '',
+    logGroupName: '',
+    logStreamName: '',
+    memoryLimitInMB: '',
+    getRemainingTimeInMillis: () => 1000,
+    done: () => { },
+    fail: () => { },
+    succeed: () => { }
+  }
+}
 
 test('source image cache pruning', async (t) => {
   const filePath = join(__dirname, '..', 'example', 'public', 'img', 'test.jpg')
@@ -64,20 +81,7 @@ test('source image cache pruning', async (t) => {
         isBase64Encoded: false,
         body: null
       },
-      {
-        functionName: 'ipx',
-        callbackWaitsForEmptyEventLoop: false,
-        functionVersion: '1',
-        invokedFunctionArn: '',
-        awsRequestId: '',
-        logGroupName: '',
-        logStreamName: '',
-        memoryLimitInMB: '',
-        getRemainingTimeInMillis: () => 1000,
-        done: () => { },
-        fail: () => { },
-        succeed: () => { }
-      }
+      getHandlerContext()
     )
     if (response) {
       t.is(response.statusCode, 200)
@@ -96,3 +100,86 @@ test('source image cache pruning', async (t) => {
     'cache size should not be equal to number of images * image size if we exceed threshold'
   )
 })
+
+test('should add WAF headers to local images being transformed', async (t) => {
+  const handler = createIPXHandler({
+    basePath: '/_ipx/',
+    cacheDir: '/tmp/ipx-cache',
+    bypassDomainCheck: true
+  }, (sourceImageOptions) => {
+    t.assert(sourceImageOptions.requestHeaders && sourceImageOptions.requestHeaders['X-Nf-Waf-Bypass-Token'] === 'some token')
+
+    return Promise.resolve({ finalize: () => { } } as SourceImageResult)
+  })
+
+  await handler(
+    {
+      rawUrl: 'http://localhost:3000/some-path',
+      path: '/_ipx/w_500/no-file.jpg',
+      headers: { 'X-Nf-Waf-Bypass-Token': 'some token' },
+      rawQuery: '',
+      httpMethod: 'GET',
+      queryStringParameters: {},
+      multiValueQueryStringParameters: {},
+      multiValueHeaders: {},
+      isBase64Encoded: false,
+      body: null
+    },
+    getHandlerContext()
+  )
+})
+
+test('should not add WAF headers to remote images being transformed', async (t) => {
+  const handler = createIPXHandler({
+    basePath: '/_ipx/',
+    cacheDir: '/tmp/ipx-cache',
+    bypassDomainCheck: true
+  }, (sourceImageOptions) => {
+    t.assert(sourceImageOptions.requestHeaders && sourceImageOptions.requestHeaders['X-Nf-Waf-Bypass-Token'] === undefined)
+
+    return Promise.resolve({ finalize: () => { } } as SourceImageResult)
+  })
+
+  await handler(
+    {
+      rawUrl: 'http://localhost:3000/some-path',
+      path: '/_ipx/w_500/https%3A%2F%2Fsome-site.com%2Fno-file.jpg',
+      headers: { 'X-Nf-Waf-Bypass-Token': 'some token' },
+      rawQuery: '',
+      httpMethod: 'GET',
+      queryStringParameters: {},
+      multiValueQueryStringParameters: {},
+      multiValueHeaders: {},
+      isBase64Encoded: false,
+      body: null
+    },
+    getHandlerContext()
+  )
+})
+test('should not add WAF headers to local images if WAF is disabled', async (t) => {
+  const handler = createIPXHandler({
+    basePath: '/_ipx/',
+    cacheDir: '/tmp/ipx-cache',
+    bypassDomainCheck: true
+  }, (sourceImageOptions) => {
+    t.assert(sourceImageOptions.requestHeaders && sourceImageOptions.requestHeaders['X-Nf-Waf-Bypass-Token'] === undefined)
+
+    return Promise.resolve({ finalize: () => { } } as SourceImageResult)
+  })
+
+  await handler(
+    {
+      rawUrl: 'http://localhost:3000/some-path',
+      path: '/_ipx/w_500/no-file.jpg',
+      headers: {},
+      rawQuery: '',
+      httpMethod: 'GET',
+      queryStringParameters: {},
+      multiValueQueryStringParameters: {},
+      multiValueHeaders: {},
+      isBase64Encoded: false,
+      body: null
+    },
+    getHandlerContext()
+  )
+})