[oleksandr-nc]

The user-info lookup the agent sends to Nextcloud is a GET without a body, but it copies the client's headers onto it, Transfer-Encoding: chunked included. A streaming upload with credentials (curl -T -, a Python generator, a Node or Go stream body) then leaves Nextcloud's web server waiting for a body that never comes. When Nextcloud is served through nginx or AIO's Apache, the request fails with 401 after 25 seconds. With Apache and mod_php (the official nextcloud:apache image) it succeeds, but only after 10 seconds. An Apache reverse proxy in front of Nextcloud answers the lookup with 408 after 20 seconds, so the client gets 403 and HaRP records a failed attempt.

This happens on user, admin and public routes whenever the request carries an Authorization header or a session cookie and reaches HaRP chunked, directly or through a front proxy that passes chunked requests on (Caddy, Traefik, HAProxy, AIO, Apache for curl -T - and larger bodies, nginx with proxy_request_buffering off).

A Range header is copied as well, and Apache applies it to the lookup's answer, so a resumed download or a media seek with credentials gets 401, or 403 with a recorded failed attempt.

Changes

• The lookup leaves out the client's connection headers (Transfer-Encoding, Connection, Keep-Alive, Proxy-Connection, Upgrade, TE, Trailer), Expect, Range and every Content-* header.
• It also leaves out the proxy authentication headers Proxy-Authorization and Proxy-Authenticate, and Accept-Encoding, so Nextcloud is only offered encodings the agent can decode (browsers also offer zstd).
• A header with a control character is left out of the lookup instead of failing it with 401.
• The Docker deploy test sends a chunked request with credentials straight to HaRP.

The request HaRP forwards to the ExApp is unchanged.

[coderabbitai]

📝 Walkthrough

User-info requests now omit additional excluded headers, all content-* headers, and headers with unsendable control characters. Unit tests check forwarded headers, credential handling, and log redaction. The manual deployment test sends a chunked GET request directly to HaRP and requires an HTTP 200 response.

Priority: ➖ Normal

Merge Risk: 🔵 Low · up to 867f0

A client can cause an extra header to reach Nextcloud during a credentialed user-info lookup. Fix the filter before merging, or accept this bounded forwarding risk.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 12.50% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 2 files. (1 skipped: 1…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: excluding client headers that cause HaRP user-info lookups to fail.
Description check		The description directly explains the header-related failure, the affected request paths, and the implemented fixes. It matches the changeset.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 12.50% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 2 files. (1 skipped: 1 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 976366b5-cb77-46cd-9d73-14ae925e1170

📥 Commits

Reviewing files that changed from the base of the PR and between fae0171 and 867f00e.

📒 Files selected for processing: 3

• .github/workflows/tests-deploy-docker.yml
• haproxy_agent.py
• tests/unit/test_requests.py

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.