{"record":{"id":"9f066e7b669e9186","repo":"musistudio/claude-code-router","slug":"remote-provider-manifests-cannot-define-sensitive","errorCode":null,"errorMessage":"Remote provider manifests cannot define sensitive Fetch usage headers.","messagePattern":"Remote provider manifests cannot define sensitive Fetch usage headers\\.","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/core/src/providers/manifest-service.ts","lineNumber":319,"sourceCode":"    normalized === \"::\" ||\n    normalized === \"::1\" ||\n    normalized.startsWith(\"100:\") ||\n    normalized.startsWith(\"2001:2:\") ||\n    normalized.startsWith(\"2001:10:\") ||\n    normalized.startsWith(\"2001:db8:\") ||\n    normalized.startsWith(\"2002:\") ||\n    normalized.startsWith(\"fc\") ||\n    normalized.startsWith(\"fd\") ||\n    /^fe[89a-f]/.test(normalized) ||\n    normalized.startsWith(\"ff\")\n  );\n}\n\nfunction validateSafeHeaders(headers: Record<string, string> | undefined): void {\n  for (const key of Object.keys(headers ?? {})) {\n    const normalized = key.trim().toLowerCase();\n    if (normalized === \"authorization\" || normalized === \"cookie\" || normalized === \"proxy-authorization\") {\n      throw new Error(\"Remote provider manifests cannot define sensitive Fetch usage headers.\");\n    }\n  }\n}\n\nfunction isJsonContentType(value: string): boolean {\n  return value === \"application/json\" || value.endsWith(\"+json\");\n}\n\nfunction headerValue(value: string | string[] | number | undefined): string {\n  if (Array.isArray(value)) {\n    return value[0] ?? \"\";\n  }\n  return value === undefined ? \"\" : String(value);\n}\n","sourceCodeStart":301,"sourceCodeEnd":334,"githubUrl":"https://github.com/musistudio/claude-code-router/blob/99f24806c6a2c660b16e53e95211c517448a6c90/packages/core/src/providers/manifest-service.ts#L301-L334","documentation":"validateSafeHeaders rejects remote-managest connector Fetch usage headers named authorization, cookie, or proxy-authorization. A remote manifest must not be able to inject or override credential-carrying headers on requests made with the user's identity.","triggerScenarios":"validateRemoteAccountConnector() on a connector whose usage headers object contains any casing/whitespace variant of 'authorization', 'cookie', or 'proxy-authorization' (keys are trimmed and lowercased before comparison).","commonSituations":"Manifest author copies a working curl command including an Authorization header; connector config templates that set Cookie for session auth; attempts to forward proxy credentials.","solutions":["Delete the sensitive header from the manifest connector's usage headers","Rely on the platform's own auth injection (API key / OAuth config) instead of manifest-supplied headers","Rename genuinely non-sensitive custom headers (they are allowed as long as they are not the three blocked names)"],"exampleFix":"// before\n\"usage\": { \"headers\": { \"Authorization\": \"Bearer x\" } }\n// after\n\"usage\": { \"headers\": { \"X-Client\": \"my-app\" } }","handlingStrategy":"validation","validationCode":"const SENSITIVE = new Set(['authorization','cookie','proxy-authorization']);\nfor (const k of Object.keys(headers ?? {})) if (SENSITIVE.has(k.trim().toLowerCase())) throw new Error('sensitive header');","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Let the platform inject auth headers","Never copy curl commands with Authorization into manifest connectors"],"tags":["manifest","headers","security","connector"],"backgroundTag":"forbidden-header-rejected","analyzedSha":"99f24806c6a2c660b16e53e95211c517448a6c90","analyzedAt":"2026-08-27T04:11:01.184Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}