security: don't leak Apify token if keep_headers and Authorization header is used - #30
Merged
metalwarrior665 merged 1 commit intoAug 19, 2026
Conversation
The keep_headers=true parameter copied every inbound header onto the outbound request, including the Authorization header that callers use to authenticate to this Actor. Any caller who authenticated with an Authorization header and scraped a URL they did not control leaked their Apify API token to that URL's operator. Because Apify tokens are account-scoped, the impact reached well beyond this Actor. README.md already documented that the Authorization header is stripped in this mode; the implementation never did it. The sibling spb-/ant- prefixed forwarding path in the same function does filter headers (cookie, set-cookie, host), so the mechanism existed but was not applied here. Strip authorization and proxy-authorization in the keep_headers path, and update the README to state the guarantee it now actually keeps. Headers explicitly opted in per-request via the spb-/ant- prefixes are unchanged: those carry a value the caller chose to send to the target. Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01Lphs4iiGsBBumxe9uezJ9B
metalwarrior665
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds security protection to prevent sensitive credential headers from being forwarded to target websites when the
keep_headersoption is enabled. This ensures that the caller's Apify API token and proxy credentials are never exposed to the scraped website's operator.Key Changes
CREDENTIAL_HEADERSconstant insrc/const.tsthat defines headers containing authentication credentials (authorizationandproxy-authorization)createRequestForCrawler()insrc/utils.tsto filter out credential headers before forwarding request headers to the target websiteAuthorizationandProxy-Authorizationheaders are never forwarded, protecting the user's Apify API tokenImplementation Details
toLowerCase()) to handle various header casing conventionshttps://claude.ai/code/session_01Lphs4iiGsBBumxe9uezJ9B