com.jimuwd.xian.registry-proxy 1.0.81 → 1.0.83

package/dist/index.js

@@ -163,21 +163,28 @@ async function fetchFromRegistry(registry, targetUrl, limiter) {
         limiter.release();
     }
 }
+function resetHeaderContentLengthIfTransferEncodingIsAbsent(safeHeaders, targetUrl, bodyData) {
+    if (!safeHeaders["transfer-encoding"]) {
+        logger.info(`Transfer-Encoding header is absent, then set the content-length header, upstream url is ${targetUrl}`);
+        safeHeaders["content-length"] = bodyData.length;
+    }
+}
 async function writeResponseToDownstreamClient(registryInfo, targetUrl, resToDownstreamClient, upstreamResponse, reqFromDownstreamClient, proxyInfo, proxyPort, registryInfos) {
     if (!upstreamResponse.ok)
         throw new Error("Only 2xx upstream response is supported");
     try {
-        const contentType = upstreamResponse.headers.get('content-type') || 'application/octet-stream';
-        const connection = upstreamResponse.headers.get("connection") || 'keep-alive';
-        // 准备通用头信息
-        const safeHeaders = { 'connection': connection, 'content-type': contentType, };
-        // 复制所有可能需要的头信息
-        const headersToCopy = ['content-encoding', 'transfer-encoding',];
+        // 准备通用响应头信息
+        const safeHeaders = {};
+        // 复制所有可能需要的头信息（不包含安全相关的敏感头信息，如access-control-allow-origin、set-cookie、server、strict-transport-security等，这意味着代理服务器向下游客户端屏蔽了这些认证等安全数据）
+        const headersToCopy = ['cache-control', 'cf-cache-status', 'cf-ray', 'connection', 'content-type', 'content-encoding', 'content-length', 'date', 'etag', 'last-modified', 'transfer-encoding', 'vary',];
         headersToCopy.forEach(header => {
             const value = upstreamResponse.headers.get(header);
             if (value)
                 safeHeaders[header] = value;
         });
+        if (!safeHeaders['content-type'])
+            safeHeaders['content-type'] = 'application/octet-stream';
+        const contentType = safeHeaders['content-type'];
         if (contentType.includes('application/json')) {
             // JSON 处理逻辑
             const data = await upstreamResponse.json();
@@ -195,10 +202,8 @@ async function writeResponseToDownstreamClient(registryInfo, targetUrl, resToDow
                 }
             }
             const bodyData = JSON.stringify(data);
-            if (!safeHeaders["transfer-encoding"]) {
-                // if transfer-encoding header is absent, then set the content-length header.
-                safeHeaders["content-length"] = bodyData.length;
-            }
+            resetHeaderContentLengthIfTransferEncodingIsAbsent(safeHeaders, targetUrl, bodyData);
+            logger.info(`Response to downstream client headers`, JSON.stringify(safeHeaders));
             resToDownstreamClient.writeHead(upstreamResponse.status, safeHeaders).end(bodyData);
         }
         else if (contentType.includes('application/octet-stream')) {
@@ -249,10 +254,7 @@ async function writeResponseToDownstreamClient(registryInfo, targetUrl, resToDow
         else {
             logger.warn(`Unsupported response content-type from upstream ${targetUrl}`);
             const bodyData = await upstreamResponse.text();
-            if (!safeHeaders["transfer-encoding"]) {
-                // if transfer-encoding header is absent, then set the content-length header.
-                safeHeaders["content-length"] = bodyData.length;
-            }
+            resetHeaderContentLengthIfTransferEncodingIsAbsent(safeHeaders, targetUrl, bodyData);
             resToDownstreamClient.writeHead(upstreamResponse.status, safeHeaders).end(bodyData);
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "com.jimuwd.xian.registry-proxy",
-  "version": "1.0.81",
+  "version": "1.0.83",
   "description": "A lightweight npm registry proxy with fallback support",
   "type": "module",
   "main": "dist/index.js",