Invalid value "undefined" for header "*"

[reinforceColumn]

Initial checklist

• I understand this is a bug report and questions should be posted in the Community Forum
• I searched issues and couldn’t find anything (or linked relevant results below)

Steps to reproduce

Hello,

integrating TUS server into my Express app but i'm getting this error

Invalid value "undefined" for header "*" when the client does his HEAD request
Using
"@tus/server": "^2.1.0", //Tested with 2.2.0 and 2.1.0
and

        "@uppy/core": "^4.4.6",
        "@uppy/react": "^4.3.0",
        "@uppy/tus": "^4.2.2",

This also happens if using react-uploady and does not happen in version 2.0.0 or version 1.x.

It seems to be related to srvx which was introduced with #749.
Error stack:

node:_http_outgoing:645
  validateHeaderValue(name, value);
  ^

TypeError [ERR_HTTP_INVALID_HEADER_VALUE]: Invalid value "undefined" for header "*"
    at ServerResponse.setHeader (node:_http_outgoing:645:3)
    at setHeadersFromArray (/usr/src/app/node_modules/on-headers/index.js:78:9)
    at ServerResponse.setWriteHeadHeaders (/usr/src/app/node_modules/on-headers/index.js:119:5)
    at ServerResponse.writeHead (/usr/src/app/node_modules/on-headers/index.js:30:36)
    at sendNodeResponse (file:///usr/src/app/node_modules/srvx/dist/adapters/node.mjs:40:13)
    at file:///usr/src/app/node_modules/srvx/dist/adapters/node.mjs:898:63 {
  code: 'ERR_HTTP_INVALID_HEADER_VALUE'
}

Thank you in advance

Expected behavior

Does not throw on request and recovers upload progress successfully

Actual behavior

NodeJS server crashes if using tusExpress.all('*', tusServer.handle.bind(tusServer))

Manually calling await tusServer.handle(req, res); gives me the chance to not crash but no upload progress is recoverd ( every download is restarted from 0)

[Murderlon]

Can you share what headers you are sending? It seems you are sending "*": "undefined" which you probably shouldn't do?

[reinforceColumn]

The headers that arrives to the server (req.headers) are these ones:

{
  host: "localhost",
  connection: "keep-alive",
  pragma: "no-cache",
  "cache-control": "no-cache",
  "sec-ch-ua-platform": "\"Linux\"",
  authorization: "Bearer AUTH_TOKEN",
  "tus-resumable": "1.0.0",
  "user-agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36",
  "sec-ch-ua": "\"Not)A;Brand\";v=\"8\", \"Chromium\";v=\"138\", \"Google Chrome\";v=\"138\"",
  "sec-ch-ua-mobile": "?0",
  accept: "*/*",
  "sec-fetch-site": "same-origin",
  "sec-fetch-mode": "cors",
  "sec-fetch-dest": "empty",
  referer: "https://localhost/",
  "accept-encoding": "gzip, deflate, br, zstd",
  "accept-language": "en-US,en;q=0.9",
}

It looks like during some parsing inside the on-headers package we pass in this func:

function setWriteHeadHeaders (statusCode) {
  var length = arguments.length
  var headerIndex = length > 1 && typeof arguments[1] === 'string'
    ? 2
    : 1

  var headers = length >= headerIndex + 1
    ? arguments[headerIndex]
    : undefined

  this.statusCode = statusCode

  if (Array.isArray(headers)) {
    // handle array case
    setHeadersFromArray(this, headers)
  } else if (headers) {
    // handle object case
    setHeadersFromObject(this, headers)
  }

  // copy leading arguments
  var args = new Array(Math.min(length, headerIndex))
  for (var i = 0; i < args.length; i++) {
    args[i] = arguments[i]
  }

  return args
}

and we pass inside the setHeadersFromArray function

function setHeadersFromArray (res, headers) {
  for (var i = 0; i < headers.length; i++) {
    res.setHeader(headers[i][0], headers[i][1]) //This breaks when headers[i] === "*"
  }
}

The headers that are passed inside setHeadersFromArray() are

[
  "access-control-allow-origin",
  "*", // This breaks 
  "access-control-expose-headers",
  "Authorization, Content-Type, Location, Tus-Extension, Tus-Max-Size, Tus-Resumable, Tus-Version, Upload-Concat, Upload-Defer-Length, Upload-Length, Upload-Metadata, Upload-Offset, X-HTTP-Method-Override, X-Requested-With, X-Forwarded-Host, X-Forwarded-Proto, Forwarded",
  "cache-control",
  "no-store",
  "content-type",
  "text/plain;charset=UTF-8",
  "tus-resumable",
  "1.0.0",
  "upload-length",
  "104857600",
  "upload-metadata",
  "name MTAwTS5maWxl,type YXBwbGljYXRpb24vb2N0ZXQtc3RyZWFt,filetype YXBwbGljYXRpb24vb2N0ZXQtc3RyZWFt,filename MTAwTS5maWxl",
  "upload-offset",
  "87310336",
]

[reinforceColumn]

For now i just cloned the repo, applied #753 and imported @tus/server from the patched version and everything seems working as expected.

If you need any info about the client implementation or something else i'll be happy to help

[Murderlon]

I don't understand what you are doing. You seem to be manually overriding the headers before or after the tus handler on your server? You shouldn't do that without expected things to break. We have options allowedCredentials, allowedOrigins, exposedHeaders to allow you to change things in a controlled way.

[reinforceColumn]

I'm not touching any of the headers manually, apart from the authorization header to add my bearer token.

Using a custom UI, so i'm not using uppy components

Upload.tsx

const [uppy] = useState(() =>
    new Uppy({}).use(Tus, {
      endpoint: 'MY_API_ENDPOINT',
      onBeforeRequest(req) {
        req.setHeader('Authorization', `Bearer ${AlwaysUpdatedAccessToken}`);
      },
      onShouldRetry(err, _retryAttempt, _options, next) {
        console.log('RETRYING');
        if (err.originalResponse?.getStatus() === 403) {
          return true;
        } else {
          return next(err);
        }
      },
      async onAfterResponse(_req, res) {
        if (res.getStatus() === 403) {
          const res = await pubApi.refreshToken();
          handleRefreshToken(res.newAccessToken, res.newRefreshToken);
        }
      },
    }),
  );

...
// Passing only single File items, never a File[]
  const addFiles = (file: File | File[]): void => {
    if (Array.isArray(file)) {
      uppy.addFiles(
        file.map((item) => ({
          name: item.name,
          data: item,
        })),
      );
    } else {
      uppy.addFile(file);
    }
  };


  const uploadFiles = (): void => {
    uppy.upload().catch((error) => console.error('error during upload', error));
  };

ApiServer

// This is the end of an endpoint, the only used middleware is an authentication middleware that adds user inside the request (req.user = user)

import express from 'express';

import { Server as TusServer } from "tus-server";
import { FileStore } from "@tus/file-store";
import config from 'src/server/config.ts';
const router = express.Router();

const tusExpress = express()

const tusServer = new TusServer({
  generateUrl: (_req, opts): string => {
    return `https://${opts.host}${opts.path}/${opts.id}`
  },
  path: "/MY/ENDPOINT/PATH/files",
  datastore: new FileStore({ directory: tmpDir }),
  relativeLocation: true
})

router.use('/files', tusExpress)

tusExpress.all('*', tusServer.handle.bind(tusServer))

export default router;