@specific.dev/spectest 0.93.1 → 0.94.0

package/dist/components/emulate/entry.mjs

@@ -179,9 +179,8 @@ Bun.serve({
     // own IP and never sends a provider name.
     if (url.pathname === "/healthz") return new Response("ok\n");
 
-    // The daemon reverse-proxies us and rewrites `Host` to the service-net
-    // name, so the provider the client asked for only survives in
-    // `X-Forwarded-Host`. Read that first; `Host` covers a direct call.
+    // Ingress preserves Host and also stamps X-Forwarded-Host with the
+    // requested authority. Host covers direct calls to the emulator.
     const host = (req.headers.get("x-forwarded-host") ?? req.headers.get("host") ?? "")
       .toLowerCase()
       .replace(/:\d+$/, "");

package/dist/components/s3.d.ts

@@ -17,9 +17,9 @@ export interface S3Options {
      * via the daemon's TLS-terminating reverse proxy. Optional — defaults to none;
      * the store is always reachable at `http://<key>:9090` regardless. Set this
      * only when the app under test hardcodes a specific prod S3 endpoint it can't
-     * be told to override (`https://<bucket>.s3.amazonaws.com`, a provider's
-     * storage host): the daemon mints a cert for each host and proxies to the
-     * store's plain HTTP. The store ignores SigV4, so the Host rewrite is harmless.
+     * be told to override (a provider's storage host; requests must still use
+     * path-style addressing): the daemon mints a cert for each host and proxies to the
+     * store's plain HTTP while preserving the requested Host.
      */
     hosts?: string[];
     /** Access key id the helper client signs with. The store ignores SigV4, so

package/dist/daemon.js

@@ -56,7 +56,7 @@ import { installFetchWrapper, isTransportError } from "./harness/fetch.js";
 import { bindInstrumentationScope, createInstrumentationScope, runInstrumented, runUninstrumented, } from "./harness/instrumentation-scope.js";
 import { encodeRegistry } from "./harness/names-registry.js";
 import { InterceptRegistry, parseTarget, runChain, } from "./harness/intercept.js";
-import { HOP_BY_HOP_HEADERS, augmentCorsResponse, corsPreflightResponse, isCorsPreflight, } from "./harness/http-proxy.js";
+import { HOP_BY_HOP_HEADERS, augmentCorsResponse, corsPreflightResponse, isCorsPreflight, upstreamRequestHeaders, } from "./harness/http-proxy.js";
 import { WS_BRIDGE_HANDLERS, openUpstreamWebSocket, parseSubprotocols, upstreamHandshakeHeaders, } from "./harness/ws-bridge.js";
 import { certCovers as hostmatchCertCovers, hostWithoutPort, matchRoute, selectCertName, wildcardSuffix, } from "./harness/hostmatch.js";
 import { INGRESS_HTTPS_PORT, INGRESS_HTTP_PORT, bindRoute, clearTables, emptyTables, planBind, registryTarget, routesFor, unbindRoute, } from "./harness/ingress-table.js";
@@ -2098,8 +2098,6 @@ server, service, port, listenerLabel, proto) {
         // and the forwardable headers. Same provenance stamps as the HTTP path.
         const protocols = parseSubprotocols(req.headers.get("sec-websocket-protocol"));
         const headers = upstreamHandshakeHeaders(req.headers, {
-            service,
-            port,
             proto,
             clientIp: ingressClientIp(server, req, proto),
         });
@@ -2127,28 +2125,10 @@ server, service, port, listenerLabel, proto) {
         }
         return new Response(`spectest-daemon: ws upgrade refused on ${listenerLabel}\n`, { status: 426, headers: { "content-type": "text/plain" } });
     }
-    const fwdHeaders = new Headers();
-    for (const [k, v] of req.headers) {
-        if (HOP_BY_HOP_HEADERS.has(k.toLowerCase()))
-            continue;
-        fwdHeaders.append(k, v);
-    }
-    // Standard reverse-proxy provenance headers: the upstream sees the
-    // public scheme/host it was reached through and the client's address,
-    // even though we rewrite Host below to the service-net name.
-    const clientIp = ingressClientIp(server, req, proto);
-    const priorXff = req.headers.get("x-forwarded-for");
-    const xff = clientIp ? (priorXff ? `${priorXff}, ${clientIp}` : clientIp) : priorXff;
-    if (xff)
-        fwdHeaders.set("x-forwarded-for", xff);
-    fwdHeaders.set("x-forwarded-proto", proto);
-    const publicHost = req.headers.get("host");
-    if (publicHost)
-        fwdHeaders.set("x-forwarded-host", publicHost);
-    // Override Host so the upstream sees its own service-net name, not
-    // the public hostname. Lets origin servers that vhost by Host header
-    // continue to find the right virtual host.
-    fwdHeaders.set("host", `${service}:${port}`);
+    const fwdHeaders = upstreamRequestHeaders(req.headers, {
+        proto,
+        clientIp: ingressClientIp(server, req, proto),
+    });
     // Fresh connection per upstream request — never reuse a pooled
     // keep-alive conn. Upstreams with short idle timeouts (uvicorn defaults
     // to 5s) close pooled connections under Bun's fetch, and the next

package/dist/harness/http-proxy.d.ts

@@ -12,13 +12,18 @@
  * Forwarding `transfer-encoding` or `content-length` from a re-encoded
  * body is the classic way to produce a response the client cannot frame;
  * forwarding `connection` leaks our keep-alive intent to the upstream.
- * `host` is here because the proxy sets its own — the upstream must see
- * the service it actually is, not the public name the client asked for.
+ * `host` identifies the requested origin and must survive the proxy hop.
  */
 export declare const HOP_BY_HOP_HEADERS: ReadonlySet<string>;
 export declare function isHopByHop(name: string): boolean;
 /** Copy headers, dropping the ones that belong to this connection. */
 export declare function forwardableHeaders(headers: Headers): Headers;
+/** Preserve the requested Host (including its port) while dialing the service's
+ * internal address. HTTP and WebSocket forwarding share this policy. */
+export declare function upstreamRequestHeaders(headers: Headers, opts: {
+    proto: string;
+    clientIp?: string;
+}): Headers;
 /**
  * A CORS preflight is an `OPTIONS` carrying both `Origin` and
  * `Access-Control-Request-Method`. An `OPTIONS` without them is a normal

package/dist/harness/http-proxy.js

@@ -12,8 +12,7 @@
  * Forwarding `transfer-encoding` or `content-length` from a re-encoded
  * body is the classic way to produce a response the client cannot frame;
  * forwarding `connection` leaks our keep-alive intent to the upstream.
- * `host` is here because the proxy sets its own — the upstream must see
- * the service it actually is, not the public name the client asked for.
+ * `host` identifies the requested origin and must survive the proxy hop.
  */
 export const HOP_BY_HOP_HEADERS = new Set([
     "connection",
@@ -24,7 +23,6 @@ export const HOP_BY_HOP_HEADERS = new Set([
     "trailers",
     "transfer-encoding",
     "upgrade",
-    "host",
 ]);
 export function isHopByHop(name) {
     return HOP_BY_HOP_HEADERS.has(name.toLowerCase());
@@ -38,6 +36,22 @@ export function forwardableHeaders(headers) {
     });
     return out;
 }
+/** Preserve the requested Host (including its port) while dialing the service's
+ * internal address. HTTP and WebSocket forwarding share this policy. */
+export function upstreamRequestHeaders(headers, opts) {
+    const out = forwardableHeaders(headers);
+    const priorXff = headers.get("x-forwarded-for");
+    const xff = opts.clientIp
+        ? priorXff ? `${priorXff}, ${opts.clientIp}` : opts.clientIp
+        : priorXff;
+    if (xff)
+        out.set("x-forwarded-for", xff);
+    out.set("x-forwarded-proto", opts.proto);
+    const host = headers.get("host");
+    if (host)
+        out.set("x-forwarded-host", host);
+    return out;
+}
 /**
  * A CORS preflight is an `OPTIONS` carrying both `Origin` and
  * `Access-Control-Request-Method`. An `OPTIONS` without them is a normal

package/dist/harness/ws-bridge.d.ts

@@ -33,11 +33,9 @@ export declare function parseSubprotocols(header: string | null | undefined): st
  * The headers the upstream handshake carries: everything forwardable from
  * the client's request (cookies, authorization, origin, user-agent …),
  * minus the client's own handshake fields, plus the proxy provenance
- * headers and a Host that names the service.
+ * headers and the original Host.
  */
 export declare function upstreamHandshakeHeaders(req: Headers, opts: {
-    service: string;
-    port: number;
     proto: string;
     clientIp?: string;
 }): Record<string, string>;

package/dist/harness/ws-bridge.js

@@ -19,7 +19,7 @@
  * the handshake and the frame relay so the two can be tested on loopback
  * without a VM.
  */
-import { forwardableHeaders } from "./http-proxy.js";
+import { upstreamRequestHeaders } from "./http-proxy.js";
 /** Headers that belong to the client's own WebSocket handshake. Bun's
  *  WebSocket client mints its own key and version, and the protocol list
  *  goes through the constructor option, so these never travel as plain
@@ -46,28 +46,15 @@ export function parseSubprotocols(header) {
  * The headers the upstream handshake carries: everything forwardable from
  * the client's request (cookies, authorization, origin, user-agent …),
  * minus the client's own handshake fields, plus the proxy provenance
- * headers and a Host that names the service.
+ * headers and the original Host.
  */
 export function upstreamHandshakeHeaders(req, opts) {
     const out = {};
-    forwardableHeaders(req).forEach((value, key) => {
+    upstreamRequestHeaders(req, opts).forEach((value, key) => {
         if (HANDSHAKE_HEADERS.has(key))
             return;
         out[key] = value;
     });
-    const priorXff = req.get("x-forwarded-for");
-    const xff = opts.clientIp
-        ? priorXff
-            ? `${priorXff}, ${opts.clientIp}`
-            : opts.clientIp
-        : priorXff;
-    if (xff)
-        out["x-forwarded-for"] = xff;
-    out["x-forwarded-proto"] = opts.proto;
-    const publicHost = req.get("host");
-    if (publicHost)
-        out["x-forwarded-host"] = publicHost;
-    out["host"] = `${opts.service}:${opts.port}`;
     return out;
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@specific.dev/spectest",
-  "version": "0.93.1",
+  "version": "0.94.0",
   "description": "Spectest SDK for defining test environments in TypeScript.",
   "type": "module",
   "main": "./dist/index.js",

package/src/components/emulate/entry.mjs

@@ -179,9 +179,8 @@ Bun.serve({
     // own IP and never sends a provider name.
     if (url.pathname === "/healthz") return new Response("ok\n");
 
-    // The daemon reverse-proxies us and rewrites `Host` to the service-net
-    // name, so the provider the client asked for only survives in
-    // `X-Forwarded-Host`. Read that first; `Host` covers a direct call.
+    // Ingress preserves Host and also stamps X-Forwarded-Host with the
+    // requested authority. Host covers direct calls to the emulator.
     const host = (req.headers.get("x-forwarded-host") ?? req.headers.get("host") ?? "")
       .toLowerCase()
       .replace(/:\d+$/, "");

package/src/components/s3.ts

@@ -20,9 +20,9 @@ export interface S3Options {
    * via the daemon's TLS-terminating reverse proxy. Optional — defaults to none;
    * the store is always reachable at `http://<key>:9090` regardless. Set this
    * only when the app under test hardcodes a specific prod S3 endpoint it can't
-   * be told to override (`https://<bucket>.s3.amazonaws.com`, a provider's
-   * storage host): the daemon mints a cert for each host and proxies to the
-   * store's plain HTTP. The store ignores SigV4, so the Host rewrite is harmless.
+   * be told to override (a provider's storage host; requests must still use
+   * path-style addressing): the daemon mints a cert for each host and proxies to the
+   * store's plain HTTP while preserving the requested Host.
    */
   hosts?: string[];
   /** Access key id the helper client signs with. The store ignores SigV4, so

package/src/daemon.ts

@@ -130,6 +130,7 @@ import {
   augmentCorsResponse,
   corsPreflightResponse,
   isCorsPreflight,
+  upstreamRequestHeaders,
 } from "./harness/http-proxy.js";
 import {
   WS_BRIDGE_HANDLERS,
@@ -2579,8 +2580,6 @@ async function proxyToService(
     // and the forwardable headers. Same provenance stamps as the HTTP path.
     const protocols = parseSubprotocols(req.headers.get("sec-websocket-protocol"));
     const headers = upstreamHandshakeHeaders(req.headers, {
-      service,
-      port,
       proto,
       clientIp: ingressClientIp(server, req, proto),
     });
@@ -2614,25 +2613,10 @@ async function proxyToService(
     );
   }
 
-  const fwdHeaders = new Headers();
-  for (const [k, v] of req.headers) {
-    if (HOP_BY_HOP_HEADERS.has(k.toLowerCase())) continue;
-    fwdHeaders.append(k, v);
-  }
-  // Standard reverse-proxy provenance headers: the upstream sees the
-  // public scheme/host it was reached through and the client's address,
-  // even though we rewrite Host below to the service-net name.
-  const clientIp = ingressClientIp(server, req, proto);
-  const priorXff = req.headers.get("x-forwarded-for");
-  const xff = clientIp ? (priorXff ? `${priorXff}, ${clientIp}` : clientIp) : priorXff;
-  if (xff) fwdHeaders.set("x-forwarded-for", xff);
-  fwdHeaders.set("x-forwarded-proto", proto);
-  const publicHost = req.headers.get("host");
-  if (publicHost) fwdHeaders.set("x-forwarded-host", publicHost);
-  // Override Host so the upstream sees its own service-net name, not
-  // the public hostname. Lets origin servers that vhost by Host header
-  // continue to find the right virtual host.
-  fwdHeaders.set("host", `${service}:${port}`);
+  const fwdHeaders = upstreamRequestHeaders(req.headers, {
+    proto,
+    clientIp: ingressClientIp(server, req, proto),
+  });
   // Fresh connection per upstream request — never reuse a pooled
   // keep-alive conn. Upstreams with short idle timeouts (uvicorn defaults
   // to 5s) close pooled connections under Bun's fetch, and the next

package/src/harness/http-proxy.test.ts

@@ -6,6 +6,7 @@ import {
   forwardableHeaders,
   isCorsPreflight,
   isHopByHop,
+  upstreamRequestHeaders,
 } from "./http-proxy";
 
 describe("hop-by-hop headers", () => {
@@ -13,7 +14,7 @@ describe("hop-by-hop headers", () => {
     expect(isHopByHop("Connection")).toBe(true);
     expect(isHopByHop("TRANSFER-ENCODING")).toBe(true);
     expect(isHopByHop("upgrade")).toBe(true);
-    expect(isHopByHop("host")).toBe(true);
+    expect(isHopByHop("host")).toBe(false);
   });
 
   test("ordinary headers are forwardable", () => {
@@ -23,8 +24,7 @@ describe("hop-by-hop headers", () => {
   });
 
   /** Forwarding transfer-encoding from a re-encoded body produces a
-   *  response the client cannot frame; forwarding host would hide which
-   *  service the upstream actually is. */
+   *  response the client cannot frame. Host identifies the requested origin. */
   test("forwardableHeaders drops them and keeps the rest", () => {
     const h = new Headers({
       host: "app.test",
@@ -34,7 +34,7 @@ describe("hop-by-hop headers", () => {
       "content-type": "application/json",
     });
     const out = forwardableHeaders(h);
-    expect(out.get("host")).toBeNull();
+    expect(out.get("host")).toBe("app.test");
     expect(out.get("connection")).toBeNull();
     expect(out.get("transfer-encoding")).toBeNull();
     expect(out.get("authorization")).toBe("Bearer x");
@@ -49,6 +49,68 @@ describe("hop-by-hop headers", () => {
   });
 });
 
+describe("upstream request headers", () => {
+  test("preserves authority and stamps forwarding headers from the incoming request", () => {
+    const headers = upstreamRequestHeaders(new Headers({
+      host: "bucket.storage.test:8443",
+      "x-forwarded-host": "unrelated.test",
+      "x-forwarded-proto": "http",
+      "x-forwarded-for": "10.0.0.1",
+      authorization: "signed-request",
+    }), { proto: "https", clientIp: "10.0.0.2" });
+    expect(headers.get("host")).toBe("bucket.storage.test:8443");
+    expect(headers.get("x-forwarded-host")).toBe("bucket.storage.test:8443");
+    expect(headers.get("x-forwarded-proto")).toBe("https");
+    expect(headers.get("x-forwarded-for")).toBe("10.0.0.1, 10.0.0.2");
+    expect(headers.get("authorization")).toBe("signed-request");
+  });
+
+  test.each(["http", "https"])("%s ingress forwards Host to a separately addressed upstream", async (proto) => {
+    const upstream = Bun.serve({
+      port: 0, hostname: "127.0.0.1",
+      async fetch(req) {
+        const url = new URL(req.url);
+        return Response.json({
+          host: req.headers.get("host"),
+          forwardedHost: req.headers.get("x-forwarded-host"),
+          forwardedProto: req.headers.get("x-forwarded-proto"),
+          authorization: req.headers.get("authorization"),
+          method: req.method, path: url.pathname + url.search, body: await req.text(),
+        });
+      },
+    });
+    // Both listeners in the daemon speak HTTP; HTTPS reaches one through the
+    // TLS terminator, with proto supplied explicitly to the forwarding path.
+    const proxy = Bun.serve({
+      port: 0, hostname: "127.0.0.1",
+      fetch(req) {
+        const url = new URL(req.url);
+        const headers = upstreamRequestHeaders(req.headers, { proto });
+        return fetch(new Request(new URL(url.pathname + url.search, upstream.url), {
+          method: req.method, headers, body: req.body, redirect: "manual",
+        }));
+      },
+    });
+    try {
+      for (const host of ["storage.test", "bucket.storage.test:8443"]) {
+        const res = await fetch(new URL("/uploads/file?generation=7", proxy.url), {
+          method: "PUT", body: "contents",
+          headers: { host, authorization: "signed-request" },
+        });
+        expect(res.status).toBe(200);
+        expect(await res.json()).toEqual({
+          host, forwardedHost: host, forwardedProto: proto,
+          authorization: "signed-request", method: "PUT",
+          path: "/uploads/file?generation=7", body: "contents",
+        });
+      }
+    } finally {
+      proxy.stop(true);
+      upstream.stop(true);
+    }
+  });
+});
+
 describe("preflight detection", () => {
   const req = (method: string, headers: Record<string, string>) =>
     new Request("http://app.test/", { method, headers });

package/src/harness/http-proxy.ts

@@ -13,8 +13,7 @@
  * Forwarding `transfer-encoding` or `content-length` from a re-encoded
  * body is the classic way to produce a response the client cannot frame;
  * forwarding `connection` leaks our keep-alive intent to the upstream.
- * `host` is here because the proxy sets its own — the upstream must see
- * the service it actually is, not the public name the client asked for.
+ * `host` identifies the requested origin and must survive the proxy hop.
  */
 export const HOP_BY_HOP_HEADERS: ReadonlySet<string> = new Set([
   "connection",
@@ -25,7 +24,6 @@ export const HOP_BY_HOP_HEADERS: ReadonlySet<string> = new Set([
   "trailers",
   "transfer-encoding",
   "upgrade",
-  "host",
 ]);
 
 export function isHopByHop(name: string): boolean {
@@ -41,6 +39,24 @@ export function forwardableHeaders(headers: Headers): Headers {
   return out;
 }
 
+/** Preserve the requested Host (including its port) while dialing the service's
+ * internal address. HTTP and WebSocket forwarding share this policy. */
+export function upstreamRequestHeaders(
+  headers: Headers,
+  opts: { proto: string; clientIp?: string },
+): Headers {
+  const out = forwardableHeaders(headers);
+  const priorXff = headers.get("x-forwarded-for");
+  const xff = opts.clientIp
+    ? priorXff ? `${priorXff}, ${opts.clientIp}` : opts.clientIp
+    : priorXff;
+  if (xff) out.set("x-forwarded-for", xff);
+  out.set("x-forwarded-proto", opts.proto);
+  const host = headers.get("host");
+  if (host) out.set("x-forwarded-host", host);
+  return out;
+}
+
 /**
  * A CORS preflight is an `OPTIONS` carrying both `Origin` and
  * `Access-Control-Request-Method`. An `OPTIONS` without them is a normal

package/src/harness/ws-bridge.test.ts

@@ -20,7 +20,7 @@ describe("parseSubprotocols", () => {
 describe("upstreamHandshakeHeaders", () => {
   test("forwards cookies and origin, drops the client's handshake fields, stamps provenance", () => {
     const req = new Headers({
-      host: "api.prod.specific.dev",
+      host: "api.prod.specific.dev:8443",
       connection: "Upgrade",
       upgrade: "websocket",
       "sec-websocket-key": "abc==",
@@ -32,16 +32,14 @@ describe("upstreamHandshakeHeaders", () => {
       authorization: "Bearer t",
     });
     const out = upstreamHandshakeHeaders(req, {
-      service: "api",
-      port: 4000,
       proto: "https",
       clientIp: "10.0.0.7",
     });
     expect(out["cookie"]).toBe("sid=1");
     expect(out["origin"]).toBe("https://app.test");
     expect(out["authorization"]).toBe("Bearer t");
-    expect(out["host"]).toBe("api:4000");
-    expect(out["x-forwarded-host"]).toBe("api.prod.specific.dev");
+    expect(out["host"]).toBe("api.prod.specific.dev:8443");
+    expect(out["x-forwarded-host"]).toBe("api.prod.specific.dev:8443");
     expect(out["x-forwarded-proto"]).toBe("https");
     expect(out["x-forwarded-for"]).toBe("10.0.0.7");
     for (const k of Object.keys(out)) {
@@ -52,8 +50,6 @@ describe("upstreamHandshakeHeaders", () => {
 
   test("appends the client to an existing x-forwarded-for", () => {
     const out = upstreamHandshakeHeaders(new Headers({ "x-forwarded-for": "1.2.3.4" }), {
-      service: "api",
-      port: 1,
       proto: "http",
       clientIp: "10.0.0.7",
     });
@@ -71,7 +67,7 @@ describe("the bridge on loopback", () => {
   let upstream: ReturnType<typeof Bun.serve>;
   let bridge: ReturnType<typeof Bun.serve>;
   /** What the upstream saw on its last handshake. */
-  let seen: { protocols: string[]; cookie: string | null; xfh: string | null } | null = null;
+  let seen: { protocols: string[]; cookie: string | null; host: string | null; xfh: string | null } | null = null;
 
   beforeAll(() => {
     upstream = Bun.serve({
@@ -81,6 +77,7 @@ describe("the bridge on loopback", () => {
         seen = {
           protocols,
           cookie: req.headers.get("cookie"),
+          host: req.headers.get("host"),
           xfh: req.headers.get("x-forwarded-host"),
         };
         if (protocols[1] !== "ticket-ok") return new Response("Unauthorized", { status: 401 });
@@ -110,8 +107,6 @@ describe("the bridge on loopback", () => {
       async fetch(req, server) {
         const protocols = parseSubprotocols(req.headers.get("sec-websocket-protocol"));
         const headers = upstreamHandshakeHeaders(req.headers, {
-          service: "api",
-          port: upstream.port!,
           proto: "https",
         });
         const url = new URL(req.url);
@@ -153,7 +148,7 @@ describe("the bridge on loopback", () => {
     ) => WebSocket;
     const ws = new Ctor(`ws://127.0.0.1:${bridge.port}/console?x=1`, {
       protocols,
-      headers: { cookie: "sid=abc", host: "api.prod.specific.dev" },
+      headers: { cookie: "sid=abc", host: "api.prod.specific.dev:8443" },
     });
     ws.binaryType = "arraybuffer";
     const events: Array<{ kind: "open" | "message" | "close" | "error"; value?: unknown }> = [];
@@ -180,7 +175,8 @@ describe("the bridge on loopback", () => {
     expect(seen).toEqual({
       protocols: ["console", "ticket-ok"],
       cookie: "sid=abc",
-      xfh: "api.prod.specific.dev",
+      host: "api.prod.specific.dev:8443",
+      xfh: "api.prod.specific.dev:8443",
     });
     await Bun.sleep(20);
     ws.send("hi");

package/src/harness/ws-bridge.ts

@@ -20,7 +20,7 @@
  * without a VM.
  */
 
-import { forwardableHeaders } from "./http-proxy.js";
+import { upstreamRequestHeaders } from "./http-proxy.js";
 
 /** Headers that belong to the client's own WebSocket handshake. Bun's
  *  WebSocket client mints its own key and version, and the protocol list
@@ -56,33 +56,20 @@ export function parseSubprotocols(header: string | null | undefined): string[] {
  * The headers the upstream handshake carries: everything forwardable from
  * the client's request (cookies, authorization, origin, user-agent …),
  * minus the client's own handshake fields, plus the proxy provenance
- * headers and a Host that names the service.
+ * headers and the original Host.
  */
 export function upstreamHandshakeHeaders(
   req: Headers,
   opts: {
-    service: string;
-    port: number;
     proto: string;
     clientIp?: string;
   },
 ): Record<string, string> {
   const out: Record<string, string> = {};
-  forwardableHeaders(req).forEach((value, key) => {
+  upstreamRequestHeaders(req, opts).forEach((value, key) => {
     if (HANDSHAKE_HEADERS.has(key)) return;
     out[key] = value;
   });
-  const priorXff = req.get("x-forwarded-for");
-  const xff = opts.clientIp
-    ? priorXff
-      ? `${priorXff}, ${opts.clientIp}`
-      : opts.clientIp
-    : priorXff;
-  if (xff) out["x-forwarded-for"] = xff;
-  out["x-forwarded-proto"] = opts.proto;
-  const publicHost = req.get("host");
-  if (publicHost) out["x-forwarded-host"] = publicHost;
-  out["host"] = `${opts.service}:${opts.port}`;
   return out;
 }