fix(proxy): remove internal identifiers from upstream requests #1463

Author: 0xJacky

internal/middleware/proxy.go

@@ -64,6 +64,10 @@ func Proxy() gin.HandlerFunc {
 		defaultDirector := proxy.Director
 		proxy.Director = func(req *http.Request) {
 			defaultDirector(req)
+			// drop proxy identifier from upstream query to avoid leaking internal ids
+			query := req.URL.Query()
+			query.Del("x_node_id")
+			req.URL.RawQuery = query.Encode()
 			req.Header.Del("X-Node-ID")
 			req.Header.Set("X-Node-Secret", node.Token)
 		}