Skip to content

insecureHTTPParser not working with proxy #6738

Open
@eg7eg7

Description

Describe the bug

When making requests to servers that return invalid header characters, the insecureHTTPParser flag works correctly for direct connections but fails to handle invalid headers when using a proxy configuration.

Current Behavior

  1. Without proxy, insecureHTTPParser: true successfully handles invalid header characters
  2. With proxy, the request fails with "Parse Error: Invalid header value char" regardless of insecureHTTPParser setting

Test Results:

  1. Direct request, insecureHTTPParser: false

    • Error: "Parse Error: Invalid header value char"
    • Status: HPE_INVALID_HEADER_TOKEN
  2. Direct request, insecureHTTPParser: true

    • Success
    • Status: 200
  3. Proxy request, insecureHTTPParser: false

    • Error: "Proxy Error: Parse Error: Invalid header value char"
    • Status: 502
  4. Proxy request, insecureHTTPParser: true

    • Error: "Proxy Error: Parse Error: Invalid header value char"
    • Status: 502

To Reproduce

Create a request to a website which returns invalid headers, for example 'https://meuitinerario.com.br'.
Set and proxy and insecureHTTPParser flag on the request

const config = {
  url: 'https://meuitinerario.com.br',
  insecureHTTPParser: true, // Should allow invalid header characters
  proxy: {
    host: 'brd.superproxy.io',
    port: 33335,
    protocol: 'http',
    auth: {
      username: '***',
      password: '***'
    }
  }
};

const response = await axios(config);

Expect status code 200, returns 502

Code snippet

import axios from "axios";
import https from "https";
import http from "http";

const username = process.env.BRD_USERNAME;
const password = process.env.BRD_PASSWORD;
const proxyUrl = `http://${username}:${password}@brd.superproxy.io:33335`;

const urls = ["https://meuitinerario.com.br"];

async function getRequest(url, insecureHTTPParser, useProxy) {
  const config = {
    url,
    headers: {},
    method: "GET",
    responseType: "arraybuffer",
    maxRedirects: 0,
    validateStatus: () => true, // This will resolve the promise for all status codes
    insecureHTTPParser, // Allow self-signed certificates and other http errors such as "Invalid header value char"
    httpsAgent: new https.Agent({
      rejectUnauthorized: false,
    }),
    httpAgent: new http.Agent({
      rejectUnauthorized: false,
    }),
    proxy: undefined,
  };

  if (useProxy) {
    const proxyUrlObject = new URL(proxyUrl);

    config.proxy = {
      host: proxyUrlObject.hostname,
      port: proxyUrlObject.port,
      protocol: proxyUrlObject.protocol.slice(0, -1), // remove the colon
      auth: {
        username: proxyUrlObject.username,
        password: proxyUrlObject.password,
      },
    };
  }
  try {
    const response = await axios({
      ...config,
    });

    return response;
  } catch (err) {
    return {
      status: err.code,
      error: err.message,
      reason: err.reason,
    };
  }
}

async function testSuite(url) {
  /**
   * expected failure
   */
  {
    const InsecureHTTPParser = false;
    const useProxy = false;
    const response = await getRequest(url, InsecureHTTPParser, useProxy);
    console.log({
      url,
      ...response,
      InsecureHTTPParser,
      useProxy,
    });
  }

  /**
   * expected status: 200
   */
  {
    const InsecureHTTPParser = true;
    const useProxy = false;
    const response = await getRequest(url, InsecureHTTPParser, useProxy);
    console.log({
      url,
      status: response.status,
      headers: response.headers,
      InsecureHTTPParser,
      useProxy,
    });
  }

  /**
   * expected status: 502
   */
  {
    const InsecureHTTPParser = false;
    const useProxy = true;
    const response = await getRequest(url, InsecureHTTPParser, useProxy);
    console.log({
      url,
      status: response.status,
      headers: response.headers,
      InsecureHTTPParser,
      useProxy,
    });
  }

  /**
   * expected status: 200
   *
   */
  {
    const InsecureHTTPParser = true;
    const useProxy = true;
    const response = await getRequest(url, InsecureHTTPParser, useProxy);
    console.log({
      url,
      status: response.status,
      headers: response.headers,
      InsecureHTTPParser,
      useProxy,
    });
  }
}

async function main() {
  for (const url of urls) {
    await testSuite(url);
  }
}

main();

Expected behavior

Response code should be 200

Additional Notes

The error appears to be occurring at the proxy level, suggesting that the insecureHTTPParser flag might not be properly propagated to the proxy connection handling logic in Axios.

Axios Version

1.7.9

Adapter Version

No response

Browser

No response

Browser Version

No response

Node.js Version

23.4.0

OS

macOS Sonoma Version 14.7.1

Additional Library Versions

No response

Additional context/Screenshots

No response

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions