stacklok / toolhive / 22952704691

push

github

Fix Content-Length mismatch in authz response filter with remote proxies (#4092)

When httputil.ReverseProxy forwards a response from a remote MCP server,
it copies the backend's Content-Length header to the ResponseWriter via
Header(). ResponseFilteringWriter does not override Header(), so the
original Content-Length leaks to the real writer. After Cedar policy
filtering changes the response body size, Go's HTTP server detects the
mismatch and tears down the connection.

Delete the stale Content-Length header before writing filtered responses
for both JSON and SSE content types. Go's HTTP library will handle
correct framing automatically.

Fixes: #4044

Co-authored-by: ChandraMohan0316 <chandrashanmugam007@gmail.com>

8 of 8 new or added lines in 1 file covered. (100.0%)

47719 of 74604 relevant lines covered (63.96%)

70.66 hits per line