chore: strip Authorization header on ws redirect (#29246)

microsoft · Jan 30, 2024 · aeafd44 · aeafd44
1 parent be6ab76
commit aeafd44
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/packages/playwright-core/src/server/transport.ts b/packages/playwright-core/src/server/transport.ts
@@ -114,8 +114,10 @@ export class WebSocketTransport implements ConnectionTransport {
     });
 
     if (result.redirect) {
-      // Strip access key headers from the redirected request.
-      const newHeaders = Object.fromEntries(Object.entries(headers || {}).filter(([name]) => !name.includes('access-key')));
+      // Strip authorization headers from the redirected request.
+      const newHeaders = Object.fromEntries(Object.entries(headers || {}).filter(([name]) => {
+        return !name.includes('access-key') && name.toLowerCase() !== 'authorization';
+      }));
       return WebSocketTransport._connect(progress, result.redirect.headers.location!, newHeaders, { follow: true, hadRedirects: true }, debugLogHeader);
     }