fix: x-forwarded-proto is sanitized now

netlify · Aug 24, 2022 · 35f6406 · 35f6406
1 parent 2f418b7
commit 35f6406
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/src/index.ts b/src/index.ts
@@ -15,6 +15,8 @@ export interface IPXHandlerOptions extends Partial<IPXOptions> {
   responseHeaders?: Record<string, string>
 }
 
+const X_FORWARDED_PROTO_VALUES = ['http', 'https']
+
 export function createIPXHandler ({
   cacheDir = join(tmpdir(), 'ipx-cache'),
   basePath = '/_ipx/',
@@ -30,6 +32,8 @@ export function createIPXHandler ({
   }
   const handler: Handler = async (event, _context) => {
     const host = event.headers.host
+    event.headers['x-forwarded-proto'] = X_FORWARDED_PROTO_VALUES.includes(event.headers['x-forwarded-proto'].toLowerCase()) ? event.headers['x-forwarded-proto'] : 'http'
+
     const protocol = event.headers['x-forwarded-proto'] || 'http'
     let domains = (opts as IPXOptions).domains || []
     const remoteURLPatterns = remotePatterns || []