res.redirect cannot carry the request header I set

[YJGGZHK]

[YJGGZHK]

I can ensure that the id is set in the header before forwarding

[krzysdz]

Do you want to:

1. perform (or not) a redirect when a certain header is set,
2. remove a header from redirected request, or
3. add a header to redirected request?

1. is easy:

app.use((req, res, next) => {
    // redirect if id header is truthy
    if (req.headers.id) res.redirect('https://...');
    else next();
}

2. and 3. as far as I know are impossible. Redirections are described in RFC 9110 in section 15.4. Redirection 3xx. The RFC says (emphasis mine):

When automatically following a redirected request, the user agent SHOULD resend the original request message with the following modifications:

1. Replace the target URI with the URI referenced by the redirection response's Location header field value after resolving it relative to the original request's target URI.
2. Remove header fields that were automatically generated by the implementation, replacing them with updated values as appropriate to the new request. This includes:
   1. (...)
3. Consider removing header fields that were not automatically generated by the implementation (i.e., those present in the request because they were added by the calling context) where there are security implications; this includes but is not limited to Authorization and Cookie.
4. Change the request method according to the redirecting status code's semantics, if applicable.
5. If the request method has been changed to GET or HEAD, remove content-specific header fields, including (but not limited to) Content-Encoding, Content-Language, Content-Location, Content-Type, Content-Length, Digest, Last-Modified.

In general, the user agent (e.g. browser) sends the original request, but changes some necessary automatically generated headers (e.g. Host) and removes headers that may have security implications such as Authorization and Cookie. The list of removed headers will probably depend on the user agent - here is the list from Firefox.
The RFC does not offer a way of adding or removing custom headers when redirecting a request - whatever was in the original request is in the redirected one (with the exceptions mentioned above).

[YJGGZHK]

thank you for your answer

console.log('Original headers:', req.headers);
console.log('Proxy headers:', proxyReq.getHeaders());
Both of these output request headers have id. But the browser request does not have