Add static or dynamic custom header for each client calls.

Brice Broussolle · Brice Broussolle · commit 8b4ee92c9a9d · 2023-03-09T14:06:30.000+01:00
diff --git a/docs/oidc-client-ts.api.md b/docs/oidc-client-ts.api.md
@@ -95,6 +95,9 @@ export type CreateSignoutRequestArgs = Omit<SignoutRequestArgs, "url" | "state_d
     state?: unknown;
 };
 
+// @public (undocumented)
+export type CustomHeader = string | (() => string);
+
 // @public
 export class ErrorResponse extends Error {
     constructor(args: {
@@ -339,6 +342,7 @@ export interface OidcClientSettings {
     client_secret?: string;
     // @deprecated (undocumented)
     clockSkewInSeconds?: number;
+    customHeaders?: Record<string, CustomHeader>;
     disablePKCE?: boolean;
     display?: string;
     extraQueryParams?: Record<string, string | number | boolean>;
@@ -374,7 +378,7 @@ export interface OidcClientSettings {
 
 // @public
 export class OidcClientSettingsStore {
-    constructor({ authority, metadataUrl, metadata, signingKeys, metadataSeed, client_id, client_secret, response_type, scope, redirect_uri, post_logout_redirect_uri, client_authentication, prompt, display, max_age, ui_locales, acr_values, resource, response_mode, filterProtocolClaims, loadUserInfo, staleStateAgeInSeconds, clockSkewInSeconds, userInfoJwtIssuer, mergeClaims, disablePKCE, stateStore, refreshTokenCredentials, revokeTokenAdditionalContentTypes, fetchRequestCredentials, refreshTokenAllowedScope, extraQueryParams, extraTokenParams, }: OidcClientSettings);
+    constructor({ authority, metadataUrl, metadata, signingKeys, metadataSeed, client_id, client_secret, response_type, scope, redirect_uri, post_logout_redirect_uri, client_authentication, prompt, display, max_age, ui_locales, acr_values, resource, response_mode, filterProtocolClaims, loadUserInfo, staleStateAgeInSeconds, clockSkewInSeconds, userInfoJwtIssuer, mergeClaims, disablePKCE, stateStore, refreshTokenCredentials, revokeTokenAdditionalContentTypes, fetchRequestCredentials, refreshTokenAllowedScope, extraQueryParams, extraTokenParams, customHeaders, }: OidcClientSettings);
     // (undocumented)
     readonly acr_values: string | undefined;
     // (undocumented)
@@ -388,6 +392,8 @@ export class OidcClientSettingsStore {
     // (undocumented)
     readonly clockSkewInSeconds: number;
     // (undocumented)
+    readonly customHeaders: Record<string, CustomHeader>;
+    // (undocumented)
     readonly disablePKCE: boolean;
     // (undocumented)
     readonly display: string | undefined;
diff --git a/src/JsonService.test.ts b/src/JsonService.test.ts
@@ -8,9 +8,30 @@ import { mocked } from "jest-mock";
 
 describe("JsonService", () => {
     let subject: JsonService;
+    let customStaticHeaderSubject: JsonService;
+    let customDynamicHeaderSubject: JsonService;
+
+    const staticCustomHeaders = {
+        "Custom-Header-1": "this-is-header-1",
+        "Custom-Header-2": "this-is-header-2",
+        "acCept" : "application/fake",
+        "AuthoriZation" : "not good",
+        "Content-Type": "application/fail",
+    };
+    const dynamicCustomHeaders = {
+        "Custom-Header-1": () => "my-name-is-header-1",
+        "Custom-Header-2": () => {
+            return "my-name-is-header-2";
+        },
+        "acCept" : () => "nothing",
+        "AuthoriZation" : () => "not good",
+        "Content-Type": "application/fail",
+    };
 
     beforeEach(() =>{
         subject = new JsonService();
+        customStaticHeaderSubject = new JsonService(undefined, null, staticCustomHeaders);
+        customDynamicHeaderSubject = new JsonService(undefined, null, dynamicCustomHeaders);
     });
 
     describe("getJson", () => {
@@ -28,6 +49,42 @@ describe("JsonService", () => {
             );
         });
 
+        it("should make GET request to url with static custom headers", async () => {
+            // act
+            await expect(customStaticHeaderSubject.getJson("http://test")).rejects.toThrow();
+
+            // assert
+            expect(fetch).toBeCalledWith(
+                "http://test",
+                expect.objectContaining({
+                    headers: { 
+                        Accept: "application/json",
+                        "Custom-Header-1": "this-is-header-1",
+                        "Custom-Header-2": "this-is-header-2",
+                    },
+                    method: "GET",
+                }),
+            );
+        });
+
+        it("should make GET request to url with dynamic custom headers", async () => {
+            // act
+            await expect(customDynamicHeaderSubject.getJson("http://test")).rejects.toThrow();
+
+            // assert
+            expect(fetch).toBeCalledWith(
+                "http://test",
+                expect.objectContaining({
+                    headers: { 
+                        Accept: "application/json",
+                        "Custom-Header-1": "my-name-is-header-1",
+                        "Custom-Header-2": "my-name-is-header-2",
+                    },
+                    method: "GET",
+                }),
+            );
+        });
+
         it("should set token as authorization header", async () => {
             // act
             await expect(subject.getJson("http://test", { token: "token" })).rejects.toThrow();
@@ -42,6 +99,44 @@ describe("JsonService", () => {
             );
         });
 
+        it("should set token as authorization header with static custom headers", async () => {
+            // act
+            await expect(customStaticHeaderSubject.getJson("http://test", { token: "token" })).rejects.toThrow();
+
+            // assert
+            expect(fetch).toBeCalledWith(
+                "http://test",
+                expect.objectContaining({
+                    headers: { 
+                        Accept: "application/json",
+                        Authorization: "Bearer token",
+                        "Custom-Header-1": "this-is-header-1",
+                        "Custom-Header-2": "this-is-header-2",
+                    },
+                    method: "GET",
+                }),
+            );
+        });
+
+        it("should set token as authorization header with dynamic custom headers", async () => {
+            // act
+            await expect(customDynamicHeaderSubject.getJson("http://test", { token: "token" })).rejects.toThrow();
+
+            // assert
+            expect(fetch).toBeCalledWith(
+                "http://test",
+                expect.objectContaining({
+                    headers: { 
+                        Accept: "application/json", 
+                        Authorization: "Bearer token",
+                        "Custom-Header-1": "my-name-is-header-1",
+                        "Custom-Header-2": "my-name-is-header-2",
+                    },
+                    method: "GET",
+                }),
+            );
+        });
+
         it("should fulfill promise when http response is 200", async () => {
             // arrange
             const json = { foo: 1, bar: "test" };
@@ -185,6 +280,46 @@ describe("JsonService", () => {
             );
         });
 
+        it("should make POST request to url with custom static headers", async () => {
+            // act
+            await expect(customStaticHeaderSubject.postForm("http://test", { body: new URLSearchParams("a=b") })).rejects.toThrow();
+
+            // assert
+            expect(fetch).toBeCalledWith(
+                "http://test",
+                expect.objectContaining({
+                    headers: {
+                        Accept: "application/json",
+                        "Content-Type": "application/x-www-form-urlencoded",
+                        "Custom-Header-1": "this-is-header-1",
+                        "Custom-Header-2": "this-is-header-2",
+                    },
+                    method: "POST",
+                    body: new URLSearchParams(),
+                }),
+            );
+        });
+
+        it("should make POST request to url with custom dynamic headers", async () => {
+            // act
+            await expect(customDynamicHeaderSubject.postForm("http://test", { body: new URLSearchParams("a=b") })).rejects.toThrow();
+
+            // assert
+            expect(fetch).toBeCalledWith(
+                "http://test",
+                expect.objectContaining({
+                    headers: {
+                        Accept: "application/json",
+                        "Content-Type": "application/x-www-form-urlencoded",
+                        "Custom-Header-1": "my-name-is-header-1",
+                        "Custom-Header-2": "my-name-is-header-2",
+                    },
+                    method: "POST",
+                    body: new URLSearchParams(),
+                }),
+            );
+        });
+
         it("should set basicAuth as authorization header", async () => {
             // act
             await expect(subject.postForm("http://test", { body: new URLSearchParams("payload=dummy"), basicAuth: "basicAuth" })).rejects.toThrow();
diff --git a/src/JsonService.ts b/src/JsonService.ts
@@ -9,6 +9,11 @@ import { Logger } from "./utils";
  */
 export type JwtHandler = (text: string) => Promise<Record<string, unknown>>;
 
+/**
+ * @public
+ */
+export type CustomHeader = string | (() => string);
+
 /**
  * @internal
  */
@@ -27,6 +32,33 @@ export interface PostFormOpts {
     initCredentials?: "same-origin" | "include" | "omit";
 }
 
+/**
+ * @internal
+ */
+function appendCustomHeaders(
+    headers: Record<string, string>,
+    customs: Record<string, CustomHeader>,
+): void {
+    const customKeys = Object.keys(customs);
+    const protectedHeaders = [
+        "authorization",
+        "accept",
+        "content-type",
+    ];
+    if (customKeys.length === 0) {
+        return;
+    }
+    customKeys.forEach((headerName) => {
+        if (protectedHeaders.includes(headerName.toLocaleLowerCase())) {
+            return;
+        }
+        const content = (typeof customs[headerName] === "function") ?
+            (customs[headerName] as ()=>string)() :
+            customs[headerName];
+        headers[headerName] = content as string;
+    });
+}
+
 /**
  * @internal
  */
@@ -38,6 +70,7 @@ export class JsonService {
     public constructor(
         additionalContentTypes: string[] = [],
         private _jwtHandler: JwtHandler | null = null,
+        private _customHeaders: Record<string, CustomHeader> = {},
     ) {
         this._contentTypes.push(...additionalContentTypes, "application/json");
         if (_jwtHandler) {
@@ -85,6 +118,8 @@ export class JsonService {
             headers["Authorization"] = "Bearer " + token;
         }
 
+        appendCustomHeaders(headers, this._customHeaders);
+
         let response: Response;
         try {
             logger.debug("url:", url);
@@ -136,6 +171,7 @@ export class JsonService {
         if (basicAuth !== undefined) {
             headers["Authorization"] = "Basic " + basicAuth;
         }
+        appendCustomHeaders(headers, this._customHeaders);
 
         let response: Response;
         try {
diff --git a/src/MetadataService.ts b/src/MetadataService.ts
@@ -11,7 +11,7 @@ import type { OidcMetadata } from "./OidcMetadata";
  */
 export class MetadataService {
     private readonly _logger = new Logger("MetadataService");
-    private readonly _jsonService = new JsonService(["application/jwk-set+json"]);
+    private readonly _jsonService;
 
     // cache
     private _metadataUrl: string;
@@ -21,7 +21,11 @@ export class MetadataService {
 
     public constructor(private readonly _settings: OidcClientSettingsStore) {
         this._metadataUrl = this._settings.metadataUrl;
-
+        this._jsonService = new JsonService(
+            ["application/jwk-set+json"],
+            null,
+            this._settings.customHeaders,
+        );
         if (this._settings.signingKeys) {
             this._logger.debug("using signingKeys from settings");
             this._signingKeys = this._settings.signingKeys;
diff --git a/src/OidcClientSettings.test.ts b/src/OidcClientSettings.test.ts
@@ -526,4 +526,36 @@ describe("OidcClientSettings", () => {
             expect(subject.extraTokenParams).toEqual({ "resourceServer": "abc" });
         });
     });
+
+    describe("customHeaders", () => {
+
+        it("should use default value", () => {
+            // act
+            const subject = new OidcClientSettingsStore({
+                authority: "authority",
+                client_id: "client",
+                redirect_uri: "redirect",
+            });
+
+            // assert
+            expect(subject.customHeaders).toEqual({});
+        });
+
+        it("should return value from initial settings", () => {
+            // act
+            const customHeaders = {
+                "Header-1": "this-is-a-test",
+                "Header-3": () => "dynamic header",
+            };
+            const subject = new OidcClientSettingsStore({
+                authority: "authority",
+                client_id: "client",
+                redirect_uri: "redirect",
+                customHeaders: customHeaders,
+            });
+
+            // assert
+            expect(subject.customHeaders).toEqual(customHeaders);
+        });
+    });
 });
diff --git a/src/OidcClientSettings.ts b/src/OidcClientSettings.ts
@@ -5,6 +5,7 @@ import { WebStorageStateStore } from "./WebStorageStateStore";
 import type { OidcMetadata } from "./OidcMetadata";
 import type { StateStore } from "./StateStore";
 import { InMemoryWebStorage } from "./InMemoryWebStorage";
+import type { CustomHeader } from "./JsonService";
 
 const DefaultResponseType = "code";
 const DefaultScope = "openid";
@@ -130,6 +131,11 @@ export interface OidcClientSettings {
      * Only scopes in this list will be passed in the token refresh request.
      */
     refreshTokenAllowedScope?: string | undefined;
+
+    /**
+     * Set additional custom headers to be passed to the client
+     */
+    customHeaders?: Record<string, CustomHeader>;
 }
 
 /**
@@ -182,6 +188,9 @@ export class OidcClientSettingsStore {
     public readonly fetchRequestCredentials: RequestCredentials;
     public readonly refreshTokenAllowedScope: string | undefined;
     public readonly disablePKCE: boolean;
+
+    // headers
+    public readonly customHeaders: Record<string, CustomHeader>;
     
     public constructor({
         // metadata related
@@ -209,6 +218,8 @@ export class OidcClientSettingsStore {
         // extra query params
         extraQueryParams = {},
         extraTokenParams = {},
+        // custom headers
+        customHeaders = {},
     }: OidcClientSettings) {
 
         this.authority = authority;
@@ -272,5 +283,6 @@ export class OidcClientSettingsStore {
 
         this.extraQueryParams = extraQueryParams;
         this.extraTokenParams = extraTokenParams;
+        this.customHeaders = customHeaders;
     }
 }
diff --git a/src/TokenClient.ts b/src/TokenClient.ts
@@ -66,7 +66,11 @@ export class TokenClient {
         private readonly _settings: OidcClientSettingsStore,
         private readonly _metadataService: MetadataService,
     ) {
-        this._jsonService = new JsonService(this._settings.revokeTokenAdditionalContentTypes);
+        this._jsonService = new JsonService(
+            this._settings.revokeTokenAdditionalContentTypes,
+            null,
+            this._settings.customHeaders,
+        );
     }
 
     public async exchangeCode({
diff --git a/src/UserInfoService.ts b/src/UserInfoService.ts
diff --git a/src/index.ts b/src/index.ts
