arn-browser 0.1.28 → 0.1.29

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "arn-browser",
-	"version": "0.1.28",
+	"version": "0.1.29",
 	"description": "A lightweight, browser autmation helper.",
 	"main": "src/index.js",
 	"types": "src/index.d.ts",

package/src/utility/playwright/routes/pwRoute.js

@@ -72,44 +72,77 @@ function createProxyAgent(proxyUrl) {
 }
 
 /**
- * Strips sensitive headers from outgoing request headers.
- * Removes cookie and authorization to prevent session/IP correlation.
+ * Sanitizes outgoing request headers using an allowlist approach.
+ * Only keeps essential headers needed for the server to respond correctly.
+ * Everything else (cookies, auth, fingerprint hints, HTTP/2 pseudo-headers, etc.) is stripped.
  */
 function sanitizeRequestHeaders(headers, logger, url) {
-	const cleaned = { ...headers };
+	// Allowlist of essential request headers to keep
+	const allowedHeaders = new Set([
+		"accept",
+		"accept-encoding",
+		"accept-language",
+		"referer",
+		"user-agent",
+		"sec-ch-ua",
+		"sec-ch-ua-mobile",
+		"sec-ch-ua-platform",
+		"sec-ch-ua-platform-version",
+		"sec-fetch-dest",
+		"sec-fetch-mode",
+		"sec-fetch-site",
+	]);
+
+	const cleaned = {};
 	const stripped = [];
-	// Remove known auth headers
-	if (cleaned["cookie"]) { stripped.push("cookie"); delete cleaned["cookie"]; }
-	if (cleaned["authorization"]) { stripped.push("authorization"); delete cleaned["authorization"]; }
-	// Remove any header containing auth/token/csrf keywords
-	for (const key of Object.keys(cleaned)) {
+
+	for (const [key, value] of Object.entries(headers)) {
 		const lower = key.toLowerCase();
-		if (lower.includes("token") || lower.includes("csrf") || lower.includes("auth")) {
+		if (allowedHeaders.has(lower)) {
+			cleaned[lower] = value;
+		} else {
 			stripped.push(key);
-			delete cleaned[key];
 		}
 	}
-	if (logger && stripped.length) console.log(`[stripGot] Request stripped: [${stripped.join(", ")}] → ${url}`);
+
+	if (logger && stripped.length) console.log(`[stripGot] Request stripped ${stripped.length} headers: [${stripped.join(", ")}] → ${url}`);
 	return cleaned;
 }
 
 /**
- * Sanitizes response headers for safe caching across origins.
- * - Replaces access-control-allow-origin with * (if present)
- * - Removes access-control-allow-credentials, set-cookie, CSP, HSTS
+ * Sanitizes response headers using an allowlist approach.
+ * Only keeps essential headers needed for correct content delivery.
+ * Everything else (tracking, fingerprint, security policy, cookies, etc.) is stripped.
  */
 function sanitizeResponseHeaders(headers, logger, url) {
-	const cleaned = { ...headers };
-	const changes = [];
-	if (cleaned["access-control-allow-origin"]) {
-		changes.push(`access-control-allow-origin: ${cleaned["access-control-allow-origin"]} → *`);
-		cleaned["access-control-allow-origin"] = "*";
+	// Allowlist of essential response headers to keep
+	const allowedHeaders = new Set([
+		"content-type",
+		"content-length",
+		"content-encoding",
+		"cache-control",
+		"etag",
+		"last-modified",
+		"location",
+		"access-control-allow-origin",
+		"accept-ranges",
+		"vary",
+	]);
+
+	const cleaned = {};
+	const stripped = [];
+
+	for (const [key, value] of Object.entries(headers)) {
+		const lower = key.toLowerCase();
+		if (allowedHeaders.has(lower)) {
+			// Force access-control-allow-origin to wildcard for cross-origin safety
+			cleaned[lower] = lower === "access-control-allow-origin" ? "*" : value;
+		} else {
+			stripped.push(key);
+		}
 	}
-	if (cleaned["access-control-allow-credentials"]) { changes.push("access-control-allow-credentials"); delete cleaned["access-control-allow-credentials"]; }
-	if (cleaned["set-cookie"]) { changes.push("set-cookie"); delete cleaned["set-cookie"]; }
-	if (cleaned["content-security-policy"]) { changes.push("content-security-policy"); delete cleaned["content-security-policy"]; }
-	if (cleaned["strict-transport-security"]) { changes.push("strict-transport-security"); delete cleaned["strict-transport-security"]; }
-	if (logger && changes.length) console.log(`[stripGot] Response stripped: [${changes.join(", ")}] → ${url}`);
+
+	if (logger && stripped.length) console.log(`[stripGot] Response stripped ${stripped.length} headers: [${stripped.join(", ")}] → ${url}`);
 	return cleaned;
 }