Missing content-security-policy header in response using http2 client #52096
Description
Version
18.13.0
Platform
Darwin XXX 22.5.0 Darwin Kernel Version 22.5.0: Thu Jun 8 22:22:20 PDT 2023; root:xnu-8796.121.3~7/RELEASE_ARM64_T6000 arm64 arm Darwin
(it also happens on Ubuntu 22.04)
Subsystem
http2
What steps will reproduce the bug?
Create a http2 client and perform a request to an endpoint that sets a content-security-policy HTTP header.
const http2 = require("node:http2");
const session = http2.connect("https://plantview.i.mercedes-benz.com");
session.on("error", console.error);
const req = session.request({ ":path": "/" });
req.end();
req.on("response", (headers) => {
// should display true
console.log(Object.keys(headers).includes("content-security-policy"));
});
req.on("data", (data) => {});
req.on("end", () => {
session.close();
});How often does it reproduce? Is there a required condition?
It happens consistently.
What is the expected behavior? Why is that the expected behavior?
The content-security-policy header should be present in the headers of the response event.
What do you see instead?
The content-security-policy header is missing.
Additional information
The header is visible on Node.js 18.12.1 and missing as of Node.js 18.13.0.
It works fine using node:https:
Reproduction example
const https = require("node:https");
const req2 = https.request("https://plantview.i.mercedes-benz.com");
req2.end();
req2.on("response", (req) => {
console.log(
"https",
Object.keys(req.headers).includes("content-security-policy")
);
});
req2.on("data", (data) => {});
req2.on("end", () => {
session.close();
});