Repository navigation
fix(web): drop the dropped body's framing headers from an oversize error relay - #2774
Merged
Merged
Conversation
…ror relay When /api/fetch refuses an oversized body for an error status, it relays the status and headers with no body. The relayed headers still carried content-length / transfer-encoding / content-encoding for the dropped body, so the browser rebuilt a null-body Response claiming a 5 MiB length. Those three are now omitted on that path only. Closes #2771 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Signed-off-by: cliffhall <cliff@futurescale.com>
There was a problem hiding this comment.
🟢 Approval recommended
The narrow change matches the issue requirements, preserves other response paths, and has no unresolved findings.
No open issues 🎉
What changed in this PR
Fixes oversized upstream error responses relayed through /api/fetch so their headers no longer describe a discarded body.
Changes:
- Removes
content-length,transfer-encoding, andcontent-encodingonly from oversized error responses. - Extends regression assertions to verify framing-header removal and preservation of other headers.
| File | Description |
|---|---|
| core/mcp/remote/node/server.ts | Filters dropped-body headers on the oversized-error path. |
| clients/web/src/test/integration/mcp/remote/server-extra-coverage.test.ts | Checks chunked and declared-length error responses. |
Review effort: Balanced
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #2771
Problem
When
/api/fetchrefuses an oversized upstream body for an error status, it relays the status and headers with no body, so OAuth discovery can still act on a 404. The relayed headers were the upstream's verbatim, though, including the ones that described the dropped body.createRemoteFetchrebuilds a null-bodyResponsefrom them, which then reportedcontent-length: 5242880(ortransfer-encoding: chunked) for an empty body.Change
core/mcp/remote/node/server.ts: on the oversize-error path only, the relayed headers omitcontent-length,transfer-encodingandcontent-encoding(withoutBodyFraming). Every other header is relayed as before. The success path (502) and normally relayed bodies are unchanged. Whether a normally relayed body should dropcontent-encoding/content-lengthafter undici decodes it is a separate question, and this PR leaves it alone.Tests
server-extra-coverage.test.ts, the two existing oversize-error cases:transfer-encodingis now absent, whilecontent-typeandx-probeare still relayed.content-lengthis now absent, whilecontent-typeis still relayed.The file passes 83/83. Mutation check: relaying
resHeadersunfiltered again fails exactly those two (2 failed | 81 passed).npm run local:gate: green (exit 0). An earlier run went red only onsmoke:web:browser [firefox](page.gototimeout) while the network was degraded. A paired run in the same worktree then passed with the change stashed and with it applied, and the full re-run was green.No UI change, so no screenshots.
🤖 Generated with Claude Code