fix(proxy): strip transfer-encoding header from proxied response (#1248)

amondnet · web-flow · commit 83197675cf6f · 2025-12-08T12:57:19.000+01:00
diff --git a/src/utils/proxy.ts b/src/utils/proxy.ts
@@ -88,10 +88,11 @@ export async function proxy(
   const cookies: string[] = [];
 
   for (const [key, value] of response.headers.entries()) {
-    if (key === "content-encoding") {
-      continue;
-    }
-    if (key === "content-length") {
+    if (
+      key === "content-encoding" ||
+      key === "content-length" ||
+      key === "transfer-encoding"
+    ) {
       continue;
     }
     if (key === "set-cookie") {
diff --git a/test/proxy.test.ts b/test/proxy.test.ts
@@ -168,6 +168,54 @@ describeMatrix("proxy", (t, { it, expect, describe }) => {
         expect(resText).toEqual(message);
       });
 
+      it("preserves custom headers from proxied response", async () => {
+        t.app.all("/debug", (event) => {
+          event.res.headers.set("x-custom-header", "preserved");
+          event.res.headers.set("content-type", "text/plain");
+          return "hello";
+        });
+
+        t.app.all("/", (event) => {
+          return proxyRequest(event, "/debug");
+        });
+
+        const res = await t.fetch("/", {
+          method: "GET",
+        });
+
+        // Custom headers should be preserved
+        expect(res.headers.get("x-custom-header")).toEqual("preserved");
+        // Content should be proxied correctly
+        expect(await res.text()).toEqual("hello");
+      });
+
+      it.runIf(t.target === "web")(
+        "strips transfer-encoding header from proxied response",
+        async () => {
+          t.app.all("/debug", (event) => {
+            // Simulate an upstream that sends transfer-encoding header
+            event.res.headers.set("transfer-encoding", "chunked");
+            event.res.headers.set("x-custom-header", "preserved");
+            return "hello";
+          });
+
+          t.app.all("/", (event) => {
+            return proxyRequest(event, "/debug");
+          });
+
+          const res = await t.fetch("/", {
+            method: "GET",
+          });
+
+          // transfer-encoding should be stripped by proxy()
+          // (only testable in web mode; node's HTTP server re-adds it for streaming)
+          expect(res.headers.has("transfer-encoding")).toBe(false);
+          // Other headers should be preserved
+          expect(res.headers.get("x-custom-header")).toEqual("preserved");
+          expect(await res.text()).toEqual("hello");
+        },
+      );
+
       it(
         "can handle failed proxy requests gracefully",
         async () => {
