fix: forward all request headers in record proxy#58
Merged
jpr5 merged 1 commit intoCopilotKit:mainfrom Mar 31, 2026
Merged
Conversation
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
iskhakovt
force-pushed
the
fix/proxy-forward-all-headers
branch
3 times, most recently
from
17942e9 to
917d2f6
Compare
The record proxy only forwarded a hardcoded list of headers (authorization, x-api-key, api-key, content-type, accept), silently dropping provider-specific headers like anthropic-version. This made --record mode unusable with the Anthropic API. Forward all request headers by default, excluding only hop-by-hop headers that should not be proxied (host, connection, content-length, transfer-encoding, keep-alive, upgrade).
iskhakovt
force-pushed
the
fix/proxy-forward-all-headers
branch
from
917d2f6 to
91a0744
Compare
Merged
jpr5
added a commit
that referenced
this pull request
Mar 31, 2026
## Summary Patch release capturing recorder fixes that landed since v1.6.0. ### Patch Changes - Fix record proxy to preserve upstream URL path prefixes (#57) - Fix record proxy to forward all request headers to upstream (#58) - Fix recorder to decode base64-encoded embeddings with `encoding_format: "base64"` (#64) - Guard base64 decode against corrupted data - Update CHANGELOG, skill docs, competitive matrix script ### Files changed - `package.json` — version 1.6.0 → 1.6.1 - `CHANGELOG.md` — new 1.6.1 section - `skills/write-fixtures/SKILL.md` — recorder docs updated All 1,327 tests pass. Build clean.
jpr5
added a commit
that referenced
this pull request
Apr 3, 2026
## Problem
The record proxy only forwards 5 hardcoded request headers to the
upstream provider:
`authorization`, `x-api-key`, `api-key`, `content-type`, `accept`.
Provider-specific headers are silently dropped. For example, the
Anthropic API
requires the `anthropic-version` header on every request — without it,
the API
returns 400:
```
{'type': 'error', 'error': {'type': 'invalid_request_error',
'message': 'anthropic-version: header is required'}}
```
This makes `--record` mode unusable with the Anthropic provider.
## Fix
Forward all request headers by default, stripping only headers that
should
not be proxied. The strip list is a module-level constant:
**Hop-by-hop headers** ([RFC 2616
§13.5.1](https://datatracker.ietf.org/doc/html/rfc2616#section-13.5.1)):
`connection`, `keep-alive`, `transfer-encoding`, `te`, `trailer`,
`upgrade`,
`proxy-authorization`, `proxy-authenticate`
**Set by the HTTP client** (from target URL / body):
`host`, `content-length`
**LLM proxy specific** (avoid leaking or encoding mismatch):
`cookie`, `accept-encoding`
Auth headers (`authorization`, `x-api-key`) are still forwarded —
they're
no longer special-cased since all non-stripped headers pass through.
They
continue to be excluded from saved fixture files (that logic is separate
and unchanged).
`Via` / `X-Forwarded-*` are **not** set or stripped — consistent with
how
other LLM proxy tools (LiteLLM, Portkey, Helicone) handle upstream
forwarding, and LLM APIs (OpenAI, Anthropic) do not use them.
jpr5
added a commit
that referenced
this pull request
Apr 3, 2026
## Summary Patch release capturing recorder fixes that landed since v1.6.0. ### Patch Changes - Fix record proxy to preserve upstream URL path prefixes (#57) - Fix record proxy to forward all request headers to upstream (#58) - Fix recorder to decode base64-encoded embeddings with `encoding_format: "base64"` (#64) - Guard base64 decode against corrupted data - Update CHANGELOG, skill docs, competitive matrix script ### Files changed - `package.json` — version 1.6.0 → 1.6.1 - `CHANGELOG.md` — new 1.6.1 section - `skills/write-fixtures/SKILL.md` — recorder docs updated All 1,327 tests pass. Build clean.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The record proxy only forwards 5 hardcoded request headers to the upstream provider:
authorization,x-api-key,api-key,content-type,accept.Provider-specific headers are silently dropped. For example, the Anthropic API
requires the
anthropic-versionheader on every request — without it, the APIreturns 400:
This makes
--recordmode unusable with the Anthropic provider.Fix
Forward all request headers by default, stripping only headers that should
not be proxied. The strip list is a module-level constant:
Hop-by-hop headers (RFC 2616 §13.5.1):
connection,keep-alive,transfer-encoding,te,trailer,upgrade,proxy-authorization,proxy-authenticateSet by the HTTP client (from target URL / body):
host,content-lengthLLM proxy specific (avoid leaking or encoding mismatch):
cookie,accept-encodingAuth headers (
authorization,x-api-key) are still forwarded — they'reno longer special-cased since all non-stripped headers pass through. They
continue to be excluded from saved fixture files (that logic is separate
and unchanged).
Via/X-Forwarded-*are not set or stripped — consistent with howother LLM proxy tools (LiteLLM, Portkey, Helicone) handle upstream
forwarding, and LLM APIs (OpenAI, Anthropic) do not use them.