Skip to content

Avoid duplicate response headers on Elysia 1.4.18 and earlier - #972

Open
dktsudgg wants to merge 1 commit into
fedify-dev:1.8-maintenancefrom
dktsudgg:970-elysia-http-header-deduplication
Open

Avoid duplicate response headers on Elysia 1.4.18 and earlier#972
dktsudgg wants to merge 1 commit into
fedify-dev:1.8-maintenancefrom
dktsudgg:970-elysia-http-header-deduplication

Conversation

@dktsudgg

Copy link
Copy Markdown
Contributor

Fixes #970.

@fedify/elysia's fedify() plugin copies the federation response headers into set.headers and then returns the same Response object.

When the response has a body, that Response already carries its own headers,
so on Elysia 1.4.18 and earlier(where Elysia merges set.headers into the returned response by appending unconditionally) every response header ends up duplicated.
(for example : Content-Type: application/activity+json, application/activity+json)

Elysia 1.4.19 changed the merge to skip headers the response already has, which masks the bug, but the package still supports Elysia ^1.3.6, so users on 1.4.18 and earlier receive malformed federation responses that a strict ActivityPub peer can reject.

This change moves the early return response (the case where the response has a body) above the header copy,
so the copy only runs on the bodyless path where a fresh new Response(null, …) needs the headers.
When there is a body the Response is returned untouched, so there is nothing for Elysia to merge back in, and the headers are no longer duplicated on any Elysia version.

See #970 for the details.

Assisted-by: Claude Code:claude-fable-5

When a response has a body, the plugin returns the `response` object directly,
so there is no need to copy the response's headers into Elysia's `set.headers`.
Elysia already includes `response.headers` in the HTTP response on its own.

In fact, on Elysia 1.4.18 and earlier, copying `response.headers` into `set.headers`
and then returning the response causes the HTTP response headers to be duplicated.
(This was fixed on Elysia's side in 1.4.19.)

This change therefore moves the early return of the `response` object, for the case where a body exists, above the header copy so that the HTTP response headers are no longer duplicated.

While this problem is partly due to the bug in Elysia 1.4.18 and earlier,
this fix is expected to resolve it sufficiently, so it does not raise the project's minimum Elysia version, keeping the current Elysia version support range intact.

Assisted-by: Claude Code:claude-fable-5
@coderabbitai

coderabbitai Bot commented Jul 27, 2026

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: e535bcc2-122a-483a-a8ef-c8ea59e53666

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant