unset host, if set, before sending proxy cloud run/functions request (#3025)

* unset host, if set, before sending proxy request to api client

* prepare for more headers that I may not want to copy over

* update changelog

* update logic

* fix formatting

Author: bkendall

CHANGELOG.md

@@ -1 +1,2 @@
 - Catches errors while updating authorized domains when deleting channels, printing a warning instead of failing.
+- Fixes issue where `host` header was being incorrectly set when proxying to Cloud Run or Cloud Functions for Firebase from the Hosting emulator. (#3012)

src/hosting/proxy.ts

@@ -67,7 +67,13 @@ export function proxyRequestHandler(url: string, rewriteIdentifier: string): Req
       // forward the parsed __session cookie if any
       Cookie: sessionCookie || "",
     });
+    // Skip particular header keys:
+    // - using x-forwarded-host, don't need to keep `host` in the headers.
+    const headersToSkip = new Set(["host"]);
     for (const key of Object.keys(req.headers)) {
+      if (headersToSkip.has(key)) {
+        continue;
+      }
       const value = req.headers[key];
       if (value == undefined) {
         headers.delete(key);

src/test/hosting/cloudRunProxy.spec.ts

@@ -107,6 +107,32 @@ describe("cloudRunProxy", () => {
       });
   });
 
+  it("should not send the `host` header if it's provided", async () => {
+    nock(cloudRunApiOrigin)
+      .get("/v1/projects/project-foo/locations/us-central1/services/helloworld")
+      .reply(200, { status: { url: cloudRunServiceOrigin } });
+    nock(cloudRunServiceOrigin, {
+      reqheaders: {
+        host: "helloworld-hash-uc.a.run.app:443",
+        "x-forwarded-host": "localhost:3333",
+      },
+    })
+      .get("/")
+      .reply(200, "live version");
+
+    const mwGenerator = cloudRunProxy(fakeOptions);
+    const mw = await mwGenerator(fakeRewrite);
+    const spyMw = sinon.spy(mw);
+
+    return supertest(spyMw)
+      .get("/")
+      .set("host", "localhost:3333")
+      .expect(200, "live version")
+      .then(() => {
+        expect(spyMw.calledOnce).to.be.true;
+      });
+  });
+
   it("should resolve to a live version in another region", async () => {
     const cloudRunServiceOriginAsia = "https://helloworld-hash-as.a.run.app";
     nock(cloudRunApiOrigin)