diff --git a/.changeset/giant-rice-notice.md b/.changeset/giant-rice-notice.md new file mode 100644 index 000000000000..a70e2db89593 --- /dev/null +++ b/.changeset/giant-rice-notice.md @@ -0,0 +1,5 @@ +--- +'@sveltejs/kit': patch +--- + +Prevent `Host` header from being incorrectly inherited by requests made from `load`'s `fetch` during SSR diff --git a/packages/kit/src/runtime/server/page/load_node.js b/packages/kit/src/runtime/server/page/load_node.js index 482267d5a816..650d639bc1ba 100644 --- a/packages/kit/src/runtime/server/page/load_node.js +++ b/packages/kit/src/runtime/server/page/load_node.js @@ -96,9 +96,15 @@ export async function load_node({ // merge headers from request for (const [key, value] of event.request.headers) { - if (opts.headers.has(key)) continue; - if (key === 'cookie' || key === 'authorization' || key === 'if-none-match') continue; - opts.headers.set(key, value); + if ( + key !== 'authorization' && + key !== 'cookie' && + key !== 'host' && + key !== 'if-none-match' && + !opts.headers.has(key) + ) { + opts.headers.set(key, value); + } } opts.headers.set('referer', event.url.href);