Refused to set unsafe header "host"

[raurir]

We get multiple errors in our app using useSigV4Client

The error is Refused to set unsafe header "host" on every request.

It stems from this line of code:

https://github.com/aws/aws-northstar/blob/main/packages/ui/src/components/CognitoAuth/hooks/useSigv4Client/utils/awsSigv4Fetch/index.ts#L59

We have monkey patched this by adding delete signedRequest.headers['host'], which seems very unsafe. Is there a better solution?

Thank you.

[maythetrusstbewithme]

Is there any update on this? It has been sitting for a month without triage.

[jessieweiyi]

Hi @maythetrusstbewithme sorry for the late reply.

We set the host value for Sigv4 signing as it is required in the SignedHeader at here

However, for chrome, setting of header is not allowed due to an open bug. In modern browser, we do not need to set the host header for http request as it is set by the browser. I did not see any risk on deleting it.