We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
1 parent 10ee0c4 commit dc89cfdCopy full SHA for dc89cfd
lib/eventsource.js
@@ -16,6 +16,8 @@ var lineFeed = 10
16
var carriageReturn = 13
17
// Beyond 256KB we could not observe any gain in performance
18
var maxBufferAheadAllocation = 1024 * 256
19
+// Headers matching the pattern should be removed when redirecting to different origin
20
+var reUnsafeHeader = /^(cookie|authorization)$/i
21
22
function hasBom (buf) {
23
return bom.every(function (charCode, index) {
@@ -482,7 +484,7 @@ function MessageEvent (type, eventInitDict) {
482
484
function removeUnsafeHeaders (headers) {
483
485
var safe = {}
486
for (var key in headers) {
- if (/^(cookie|authorization)$/i.test(key)) {
487
+ if (reUnsafeHeader.test(key)) {
488
continue
489
}
490
0 commit comments