{"record":{"id":"3e21a3451d46aba8","repo":"FlowiseAI/Flowise","slug":"invalid-headers-expected-an-object","errorCode":null,"errorMessage":"Invalid headers: expected an object","messagePattern":"Invalid headers: expected an object","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/components/src/headerValidation.ts","lineNumber":41,"sourceCode":"    'x-auth-token',\n    'x-amz-security-token'\n])\n\nconst REDACTED_PLACEHOLDER = '[REDACTED]'\n\nconst MAX_HEADERS = 25\nconst MAX_KEY_LENGTH = 128\nconst MAX_VALUE_LENGTH = 2048\n\n/**\n * Validates a set of user-supplied HTTP headers intended for outbound requests.\n * Rejects malformed keys, CRLF/control-char injection in values, hop-by-hop and\n * sensitive header names, and oversized payloads. Throws a plain Error; callers\n * are responsible for mapping to their own error types.\n */\nexport function validateCustomHeaders(headers: Record<string, string>): void {\n    if (!headers || typeof headers !== 'object') {\n        throw new Error('Invalid headers: expected an object')\n    }\n\n    const entries = Object.entries(headers)\n    if (entries.length > MAX_HEADERS) {\n        throw new Error(`Invalid headers: too many entries (max ${MAX_HEADERS})`)\n    }\n\n    for (const [key, value] of entries) {\n        if (typeof key !== 'string' || key.length === 0) {\n            throw new Error('Invalid header: key must be a non-empty string')\n        }\n        if (key.length > MAX_KEY_LENGTH) {\n            throw new Error(`Invalid header \"${key}\": key exceeds ${MAX_KEY_LENGTH} chars`)\n        }\n        if (!RFC7230_TOKEN.test(key)) {\n            throw new Error(`Invalid header \"${key}\": key contains illegal characters`)\n        }\n","sourceCodeStart":23,"sourceCodeEnd":59,"githubUrl":"https://github.com/FlowiseAI/Flowise/blob/abe4a8601a058047b350c260676826e21dd14101/packages/components/src/headerValidation.ts#L23-L59","documentation":"validateCustomHeaders() guards the input itself before iterating: if headers is null/undefined or typeof !== 'object', it throws. Note that JS arrays satisfy typeof === 'object', so an array will pass this guard and fail later on key/value checks; null is caught here because of the `!headers` short-circuit.","triggerScenarios":"Caller passes null, undefined, a string, a number, or a boolean where a Record<string,string> was expected.","commonSituations":"JSON.parse of an empty body returns null and is forwarded; wrong variable passed in; a deserializer returning a primitive instead of an object; optional field never populated.","solutions":["Pass a plain object (an empty object {} is valid — zero entries passes).","Validate at the API boundary before calling validateCustomHeaders; coerce null/undefined to {} or reject the request.","Guard arrays explicitly if your caller might supply one (this function does not)."],"exampleFix":"// before\nvalidateCustomHeaders(null) // throws\nvalidateCustomHeaders(JSON.parse(emptyBody)) // null -> throws\n\n// after\nvalidateCustomHeaders(headers ?? {})\nif (!headers || typeof headers !== 'object' || Array.isArray(headers)) return reject()","handlingStrategy":"type-guard","validationCode":"// Reject non-objects (and arrays) before calling validateCustomHeaders\nfunction isPlainHeaders(h) {\n    return h !== null && typeof h === 'object' && !Array.isArray(h)\n}\nif (!isPlainHeaders(headers)) throw new Error('headers must be a plain object')","typeGuard":"function isHeaderRecord(h) {\n    return h !== null && typeof h === 'object' && !Array.isArray(h)\n}","tryCatchPattern":"try {\n    validateCustomHeaders(headers)\n} catch (e) {\n    if (/expected an object/i.test(e.message)) headers = {}\n    else throw e\n}","preventionTips":["Always default to {} at API boundaries instead of forwarding null/undefined.","Reject arrays explicitly — validateCustomHeaders does not.","Validate the shape of parsed JSON before forwarding it as headers."],"tags":["headers","validation","type-guard","http"],"backgroundTag":null,"analyzedSha":"abe4a8601a058047b350c260676826e21dd14101","analyzedAt":"2026-08-12T16:04:40.823Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}