Merge pull request #1696 from navikt/nofwdcookie

fjern cookie header fra proxy requests
navikt · Oct 2, 2023 · 56fb29f · 56fb29f
2 parents a4d1a00 + 76005f7
commit 56fb29f
Show file tree

Hide file tree

Showing 3 changed files with 14 additions and 39 deletions.
diff --git a/server/package-lock.json b/server/package-lock.json
diff --git a/server/package.json b/server/package.json
@@ -8,7 +8,6 @@
         "@navikt/arbeidsgiver-notifikasjoner-brukerapi-mock": "6.4.0",
         "apollo-server-express": "3.12.1",
         "casual": "^1.6.2",
-        "cookie-parser": "^1.4.6",
         "express": "^4.17.3",
         "express-http-proxy": "1.6.3",
         "http-proxy-middleware": "3.0.0-beta.1",

diff --git a/server/server.js b/server/server.js
@@ -10,7 +10,6 @@ import httpProxyMiddleware, {
 import { createHttpTerminator } from 'http-terminator';
 import Prometheus from 'prom-client';
 import { createLogger, format, transports } from 'winston';
-import cookieParser from 'cookie-parser';
 import { tokenXMiddleware } from './tokenx.js';
 import { readFileSync } from 'fs';
 import require from './esm-require.js';
@@ -65,6 +64,13 @@ const log = new Proxy(
     }
 );
 
+const cookieScraperPlugin = (proxyServer, options) => {
+    proxyServer.on('proxyReq', (proxyReq, req, res, options) => {
+        if (proxyReq.getHeader('cookie')) {
+            proxyReq.removeHeader('cookie');
+        }
+    });
+};
 // copy with mods from http-proxy-middleware https://github.com/chimurai/http-proxy-middleware/blob/master/src/plugins/default/logger-plugin.ts
 const loggerPlugin = (proxyServer, options) => {
     proxyServer.on('error', (err, req, res, target) => {
@@ -139,7 +145,6 @@ const main = async () => {
     const app = express();
     app.disable('x-powered-by');
     app.set('views', BUILD_PATH);
-    app.use(cookieParser());
 
     app.use('/*', (req, res, next) => {
         res.setHeader('NAIS_APP_IMAGE', NAIS_APP_IMAGE);
@@ -198,7 +203,13 @@ const main = async () => {
             xfwd: true,
             changeOrigin: true,
             ejectPlugins: true,
-            plugins: [debugProxyErrorsPlugin, errorResponsePlugin, loggerPlugin, proxyEventsPlugin],
+            plugins: [
+                cookieScraperPlugin,
+                debugProxyErrorsPlugin,
+                errorResponsePlugin,
+                loggerPlugin,
+                proxyEventsPlugin,
+            ],
         };
         app.use(
             '/min-side-arbeidsgiver/tiltaksgjennomforing-api',