mirror of
https://github.com/DayuanJiang/next-ai-draw-io.git
synced 2026-10-12 20:49:53 +08:00
dayuan.jiang
55a32af76a
Two issues from before the provider refactor, found by its review. The redirect guard dropped Authorization, cookies and the providers' key headers when a redirect left the origin, but kept x-access-code, this site's own access code; it is dropped too now. edgeOneEndpoint took the request's Origin header as the site's address. Behind a proxy the request URL is the internal one and Origin is the site's, so Origin still wins, but only when its host matches Host or X-Forwarded-Host; a request carrying another site's Origin now gets the request's own origin, so the EdgeOne cookies and the access code never travel to that site.