feat: forward client request headers to upstream providers in bridge routes by ssncferreira · Pull Request #214 · coder/aibridge

ssncferreira · 2026-03-12T12:32:36Z

Description

AI Bridge acts as a reverse proxy between clients and upstream AI providers. However, bridge routes were dropping client request headers as the interceptors construct new HTTP requests via provider SDKs, which set their own headers and discard the originals.

This PR changes bridge routes to forward client request headers to upstream providers, so the upstream sees the same headers the client sent, except headers related to auth, transport, or managed by aibridge.

Changes

Add intercept/client_headers.go with SanitizeClientHeaders and BuildUpstreamHeaders. Client headers are sanitized by stripping hop-by-hop (RFC 2616), transport (Host, Accept-Encoding, Content-Length), and auth (Authorization, X-Api-Key) headers.
Add SDK middleware in all three interceptor base types that replaces the SDK-built request headers with the sanitized client headers. Two categories of headers are preserved from the SDK-built request:
- Auth headers: the SDK sets the correct provider credentials (API key or per-user token for Copilot), and these must not be overwritten by the client's auth header.
- Actor headers (X-AI-Bridge-Actor-*): injected by aibridge as per-request SDK options to identify the requesting user to the upstream.
The client-header middleware is appended before the API dump middleware, so that API dump captures the final outgoing headers as they are sent to the upstream.

This is an intermediate step toward removing the SDK from the HTTP transport path. By forwarding client headers directly, aibridge is no longer dependent on SDK-managed headers, making future SDK removal simpler.

Follow-up

Proxy headers: Passthrough routes set standard proxy headers (X-Forwarded-For, X-Forwarded-Host, X-Forwarded-Proto), while bridge routes do not. Since AI Bridge behaves as a reverse proxy, this handling should be consistent across all requests.
Inject actor headers directly in the client-header middleware instead of using per-request SDK options.
Remove ExtraHeaders mechanism for Anthropic and Copilot: now redundant since all client headers are forwarded.

Tests

Tested manually with:

✅ Claude Code 2.1.74
✅ codex-cli 0.114.0
✅ Copilot VS Code 0.38.2 (via AI Bridge Proxy)

Closes: #192

ssncferreira · 2026-03-12T12:32:50Z

feat: forward client request headers to upstream providers in bridge routes #214 👈 (View in Graphite)
main

This stack of pull requests is managed by Graphite. Learn more about stacking.

…routes

ssncferreira · 2026-03-12T20:26:03Z

intercept/chatcompletions/blocking.go

+		// TODO(ssncferreira): inject actor headers directly in the client-header
+		//   middleware instead of using SDK options.


Will handle this in a follow-up in order to not increase the scope of this PR.

ssncferreira · 2026-03-12T20:29:29Z

intercept/client_headers.go

+
+// nonForwardedHeaders are transport-level headers managed by aibridge or
+// Go's HTTP transport that must not be forwarded to the upstream provider.
+var nonForwardedHeaders = []string{


One thing I noticed is that Copilot sends a Cookie header (e.g. from API dump: Cookie: csrf...N0E=). I assume this is used for session purposes between Copilot and Github, but do you see any issue in forwarding as is upstream?

I don't think we should make many judgment calls on these sorts of things. Whatever the client sends is what we should deliver.

I'm not an expert on Cookies but from quick research I don't see why we shouldn't forward them as received.

dannykopping · 2026-03-13T08:46:37Z

intercept/client_headers.go

+
+// nonForwardedHeaders are transport-level headers managed by aibridge or
+// Go's HTTP transport that must not be forwarded to the upstream provider.
+var nonForwardedHeaders = []string{


I don't think we should make many judgment calls on these sorts of things. Whatever the client sends is what we should deliver.

dannykopping · 2026-03-13T08:47:39Z

intercept/client_headers.go

+}
+
+// authHeaders are headers that carry authentication credentials from the
+// client. These are stripped because the SDK re-injects the correct


Nit: "the SDK re-injects" can be reworded to be more explicit.
Which SDK? Where does it do that?

(i know the answers but future readers may not)

dannykopping · 2026-03-13T08:50:26Z

intercept/client_headers.go

+
+// SanitizeClientHeaders returns a copy of the client headers with hop-by-hop,
+// transport, and auth headers removed.
+func SanitizeClientHeaders(clientHeaders http.Header) http.Header {


I think Sanitize is perhaps the wrong term here. Maybe Prepare?

Since we're acting (almost) like a reverse-proxy, we should be adding in the X-Forwarded-For, X-Forwarded-Host, X-Forwarded-Proto headers here, no?

dannykopping · 2026-03-13T09:07:38Z

provider/openai_test.go

+		mockUpstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			receivedHeaders = r.Header.Clone()
+			w.Header().Set("Content-Type", "application/json")
+			w.WriteHeader(http.StatusOK)


Nit: can we use a fixture instead? It'll make the tests a bit more concise.

pawbana

Overall LGTM although it is a bit hard to review new and changes to the tests 😅

pawbana · 2026-03-13T11:38:08Z

intercept/client_headers.go

+
+// nonForwardedHeaders are transport-level headers managed by aibridge or
+// Go's HTTP transport that must not be forwarded to the upstream provider.
+var nonForwardedHeaders = []string{


I'm not an expert on Cookies but from quick research I don't see why we shouldn't forward them as received.

pawbana · 2026-03-13T11:40:09Z

provider/openai_test.go

+
+		var receivedHeaders http.Header
+
+		mockUpstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {


Would internal/integrationtest/mockupstream.go be useful here. Probably new method that creates upstreamResponse from string/bytes would be need.

I see now it may not have been a good idea to make it private 😞

pawbana · 2026-03-13T11:48:47Z

provider/openai_test.go

+func TestOpenAI_CreateInterceptor(t *testing.T) {
+	t.Parallel()
+
+	t.Run("ChatCompletions_ClientHeaders", func(t *testing.T) {


Sorry for begin pedantic about this but would it be possible to reformat this into table tests? 😅
IIUC both tests are doing basically the same but with different request path?

Maybe I'm just used to it but I feel table test format is much easier to understand and keep track of test cases. It usually also shortens the code.

From my experience AIs for some reason don't do write tests in table format first but when you ask for it directly in follow up prompt AI realizes it is possible or sometimes provides a reason why it is not worth it.

ssncferreira force-pushed the ssncf/feat-forward-client-headers-mdlw branch 3 times, most recently from a2da2f0 to 252f03a Compare March 12, 2026 19:57

feat: forward client request headers to upstream providers in bridge …

2d43f46

…routes

ssncferreira force-pushed the ssncf/feat-forward-client-headers-mdlw branch from 252f03a to 2d43f46 Compare March 12, 2026 20:16

ssncferreira commented Mar 12, 2026

View reviewed changes

ssncferreira marked this pull request as ready for review March 12, 2026 20:29

ssncferreira requested review from dannykopping and pawbana March 12, 2026 20:29

ssncferreira mentioned this pull request Mar 12, 2026

feat: forward client request headers to upstream providers in bridge routes #195

Closed

dannykopping reviewed Mar 13, 2026

View reviewed changes

pawbana approved these changes Mar 13, 2026

View reviewed changes

		// TODO(ssncferreira): inject actor headers directly in the client-header
		// middleware instead of using SDK options.


		var receivedHeaders http.Header

		mockUpstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

Conversation

ssncferreira commented Mar 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Changes

Follow-up

Tests

Uh oh!

ssncferreira commented Mar 12, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pawbana left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ssncferreira commented Mar 12, 2026 •

edited

Loading