msw 2.6.2 → 2.6.4

package/src/mockServiceWorker.js

@@ -192,12 +192,14 @@ async function getResponse(event, client, requestId) {
   const requestClone = request.clone()
 
   function passthrough() {
-    const headers = Object.fromEntries(requestClone.headers.entries())
-
-    // Remove internal MSW request header so the passthrough request
-    // complies with any potential CORS preflight checks on the server.
-    // Some servers forbid unknown request headers.
-    delete headers['x-msw-intention']
+    // Cast the request headers to a new Headers instance
+    // so the headers can be manipulated with.
+    const headers = new Headers(requestClone.headers)
+
+    // Remove the "accept" header value that marked this request as passthrough.
+    // This prevents request alteration and also keeps it compliant with the
+    // user-defined CORS policies.
+    headers.delete('accept', 'msw/passthrough')
 
     return fetch(requestClone, { headers })
   }

package/src/node/SetupServerCommonApi.ts

@@ -67,6 +67,29 @@ export class SetupServerCommonApi
             .filter(isHandlerKind('RequestHandler')),
           this.resolvedOptions,
           this.emitter,
+          {
+            onPassthroughResponse(request) {
+              const acceptHeader = request.headers.get('accept')
+
+              /**
+               * @note Remove the internal bypass request header.
+               * In the browser, this is done by the worker script.
+               * In Node.js, it has to be done here.
+               */
+              if (acceptHeader) {
+                const nextAcceptHeader = acceptHeader.replace(
+                  /(,\s+)?msw\/passthrough/,
+                  '',
+                )
+
+                if (nextAcceptHeader) {
+                  request.headers.set('accept', nextAcceptHeader)
+                } else {
+                  request.headers.delete('accept')
+                }
+              }
+            },
+          },
         )
 
         if (response) {