prevent token from being send in header for cross origin url

Author: Rohit3523

app/containers/Avatar/Avatar.tsx

@@ -4,11 +4,11 @@ import { Image } from 'expo-image';
 
 import Emoji from '../markdown/components/emoji/Emoji';
 import { getAvatarURL } from '../../lib/methods/helpers/getAvatarUrl';
+import { getAuthHeaders } from '../../lib/methods/helpers/getAuthHeaders';
 import { SubscriptionType } from '../../definitions';
 import { type IAvatar } from './interfaces';
 import I18n from '../../i18n';
 import Touch from '../Touch';
-import sdk from '../../lib/services/sdk';
 
 const Avatar = memo(
 	({
@@ -81,7 +81,7 @@ const Avatar = memo(
 					style={avatarStyle}
 					source={{
 						uri,
-						headers: sdk.getHeaders()
+						headers: uri ? getAuthHeaders(uri) : undefined
 					}}
 					priority='high'
 				/>

app/lib/methods/helpers/fetch.test.ts

@@ -2,6 +2,7 @@
 jest.mock('../../services/sdk', () => ({
 	__esModule: true,
 	default: {
+		server: 'https://open.rocket.chat',
 		getHeaders: jest.fn(),
 		setBasicAuth: jest.fn()
 	}
@@ -65,6 +66,24 @@ describe('helpers/fetch', () => {
 		fetchMock.mockResolvedValueOnce(expected);
 		await expect(customFetch('/api/v1/test')).resolves.toBe(expected);
 	});
+
+	it('attaches session headers (X-Auth-Token/X-User-Id) for same-origin requests', async () => {
+		(sdk.getHeaders as jest.Mock).mockReturnValue({ 'X-Auth-Token': 'tok', 'X-User-Id': 'uid' });
+		await customFetch('https://open.rocket.chat/api/v1/settings');
+		const call = fetchMock.mock.calls[0][1];
+		expect(call.headers['X-Auth-Token']).toBe('tok');
+		expect(call.headers['X-User-Id']).toBe('uid');
+	});
+
+	it('omits session headers but keeps default headers for cross-origin requests', async () => {
+		(sdk.getHeaders as jest.Mock).mockReturnValue({ 'User-Agent': 'RC Mobile', 'X-Auth-Token': 'tok', 'X-User-Id': 'uid' });
+		await customFetch('https://releases.rocket.chat/v2/server/supportedVersions');
+		const call = fetchMock.mock.calls[0][1];
+		expect(call.headers['X-Auth-Token']).toBeUndefined();
+		expect(call.headers['X-User-Id']).toBeUndefined();
+		expect(typeof call.headers['User-Agent']).toBe('string');
+		expect(call.headers['User-Agent']).toMatch(/RC Mobile/);
+	});
 });
 
 describe('helpers/fetch setBasicAuth', () => {

app/lib/methods/helpers/fetch.ts

@@ -1,5 +1,6 @@
 import sdk from '../../services/sdk';
 import { type DefaultHeaders, headers } from './defaultHeaders';
+import { getAuthHeaders } from './getAuthHeaders';
 
 export type TMethods = 'POST' | 'GET' | 'DELETE' | 'PUT' | 'post' | 'get' | 'delete' | 'put';
 
@@ -19,6 +20,7 @@ export const setBasicAuth = (basicAuth: string | null): void => {
 export const BASIC_AUTH_KEY = 'BASIC_AUTH_KEY';
 
 export default (url: string, options: IOptions = {}): Promise<Response> => {
-	const customOptions = { ...options, headers: { ...sdk.getHeaders(), ...(options.headers || {}) } };
+	const authHeaders = getAuthHeaders(url);
+	const customOptions = { ...options, headers: { ...authHeaders, ...(options.headers || {}) } };
 	return fetch(url, customOptions);
 };

app/lib/methods/helpers/getAuthHeaders.test.ts

@@ -0,0 +1,45 @@
+/* eslint-disable import/first */
+jest.mock('../../services/sdk', () => ({
+	__esModule: true,
+	default: {
+		server: 'https://open.rocket.chat',
+		getHeaders: jest.fn()
+	}
+}));
+
+import { getAuthHeaders } from './getAuthHeaders';
+import sdk from '../../services/sdk';
+
+describe('getAuthHeaders', () => {
+	beforeEach(() => {
+		(sdk.getHeaders as jest.Mock).mockReset();
+	});
+
+	it('returns full headers including the session token for same-origin URLs', () => {
+		(sdk.getHeaders as jest.Mock).mockReturnValue({ 'User-Agent': 'RC Mobile', 'X-Auth-Token': 'tok', 'X-User-Id': 'uid' });
+		const headers = getAuthHeaders('https://open.rocket.chat/api/v1/settings');
+		expect(headers['X-Auth-Token']).toBe('tok');
+		expect(headers['X-User-Id']).toBe('uid');
+		expect(headers['User-Agent']).toBe('RC Mobile');
+	});
+
+	it('strips only the session token for cross-origin URLs, keeping other headers', () => {
+		(sdk.getHeaders as jest.Mock).mockReturnValue({
+			'User-Agent': 'RC Mobile',
+			Authorization: 'Basic abc',
+			'X-Auth-Token': 'tok',
+			'X-User-Id': 'uid'
+		});
+		const headers = getAuthHeaders('https://releases.rocket.chat/v2/server/supportedVersions');
+		expect(headers['X-Auth-Token']).toBeUndefined();
+		expect(headers['X-User-Id']).toBeUndefined();
+		expect(headers['User-Agent']).toBe('RC Mobile');
+		expect(headers.Authorization).toBe('Basic abc');
+	});
+
+	it('treats relative URLs as same-origin', () => {
+		(sdk.getHeaders as jest.Mock).mockReturnValue({ 'X-Auth-Token': 'tok' });
+		const headers = getAuthHeaders('/api/v1/x');
+		expect(headers['X-Auth-Token']).toBe('tok');
+	});
+});

app/lib/methods/helpers/getAuthHeaders.ts

@@ -0,0 +1,19 @@
+import sdk from '../../services/sdk';
+import { isSameOrigin } from './isSameOrigin';
+
+/**
+ * Returns the request headers for a given URL.
+ * On same-origin requests the full header set is sent (including the session token).
+ * On cross-origin requests only the session token (X-Auth-Token/X-User-Id) is stripped,
+ * keeping non-sensitive headers such as User-Agent (and Basic auth) — matching the
+ * pre-migration behavior where only User-Agent/Basic auth were ever sent off-origin.
+ */
+export const getAuthHeaders = (url: string): Record<string, string> => {
+	if (isSameOrigin(url, sdk.server)) {
+		return sdk.getHeaders();
+	}
+	const headers = { ...sdk.getHeaders() };
+	delete headers['X-Auth-Token'];
+	delete headers['X-User-Id'];
+	return headers;
+};

app/lib/methods/helpers/isSameOrigin.test.ts

@@ -0,0 +1,24 @@
+import { isSameOrigin } from './isSameOrigin';
+
+describe('isSameOrigin', () => {
+	test('returns true for same-origin absolute URLs', () => {
+		expect(isSameOrigin('https://open.rocket.chat/api/v1/x', 'https://open.rocket.chat')).toBe(true);
+	});
+
+	test('returns false for cross-origin absolute URLs', () => {
+		expect(isSameOrigin('https://releases.rocket.chat/v2/server/supportedVersions', 'https://open.rocket.chat')).toBe(false);
+		expect(isSameOrigin('https://external.provider.com/avatar/user', 'https://open.rocket.chat')).toBe(false);
+	});
+
+	test('returns false when scheme differs', () => {
+		expect(isSameOrigin('http://open.rocket.chat/avatar/x', 'https://open.rocket.chat')).toBe(false);
+	});
+
+	test('returns true for relative URLs', () => {
+		expect(isSameOrigin('/api/v1/x', 'https://open.rocket.chat')).toBe(true);
+	});
+
+	test('returns true when origin is undefined', () => {
+		expect(isSameOrigin('https://releases.rocket.chat/x')).toBe(true);
+	});
+});

app/lib/methods/helpers/isSameOrigin.ts

@@ -0,0 +1,11 @@
+export const isSameOrigin = (url: string, origin?: string): boolean => {
+	if (!origin) {
+		return true;
+	}
+	try {
+		return new URL(url).origin === new URL(origin).origin;
+	} catch {
+		// Relative/internal URL — safe to attach auth headers.
+		return true;
+	}
+};