Customer headers are removed with internationalisation

[tomevans18]

What version of Next.js are you using?

10.0.3

What version of Node.js are you using?

15.3.0

What browser are you using?

Chrome

What operating system are you using?

macOS (intel)

How are you deploying your application?

Vercel

Describe the Bug

Within the next.config.js, if you have customer headers and deploy to Vercel, these headers are added to the response.
When you then add internationalisation some of these custom headers are removed.

Observed headers being removed:

• X-Frame-Options
• X-XSS-Protection
• X-Robots-Tag

Expected Behavior

Custom headers should be populated in the response when using internationalisation.

To Reproduce

1. Create a project with customer headers:

• X-Frame-Options
• X-XSS-Protection
• X-Robots-Tag

2. Deploy to Vercel and observe the custom headers within the response

3. Add internationalisation to your project

4. Deploy to Vercel

5. Observe the above noted custom headers have been removed

[tomevans18]

@Timer I noticed you removed the release milestone, is there a particular reason for this or simply workload capacity related?
I'm just trying to track this as its important from a security POV.
Many thanks!

[ijjk]

Hi @tomevans18 can you provide a minimal reproduction where you are seeing this behavior? I'm not able to reproduce this on the latest version of Next.js v10.0.7

[tomevans18]

Hi @ijjk,

I have given you access to a repo where this is happening.
I am needing to make it private due to company code.

Many thanks

[balazsorban44]

This issue has been automatically locked due to no recent activity. If you are running into a similar issue, please create a new issue with the steps to reproduce. Thank you.