security: don't leak Apify token if keep_headers and Authorization header is used

README.md

@@ -161,7 +161,7 @@ SuperScraper API supports most of the API parameters of [ScraperAPI](https://doc
 | `premium` | Use residential proxies to fetch the web content, in order to reduce the probability of being blocked. Can be either `true` or `false`, default is `false`. This is equivalent to setting ScrapingBee's `premium_proxy`.                                                                                                      |
 | `ultra_premium` | Same as `premium`.                                                                                                                                                                                                                                                                                                            |
 | `country_code` | Use IP addresses that are geolocated in the specified country by specifying its [2-letter ISO code](https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2#Officially_assigned_code_elements). When using code other than `US`, `premium_proxy` must be set to `true`. This is equivalent to setting ScrapingAnt's `proxy_country`. |
-| `keep_headers` | If `true`, then all headers sent to this Actor will be forwarded to the target website. The `Authorization` header will be removed.                                                                                                                                                                                           |
+| `keep_headers` | If `true`, then all headers sent to this Actor will be forwarded to the target website. The `Authorization` and `Proxy-Authorization` headers are never forwarded, so your Apify API token is not exposed to the target website.                                                                                                                                                                                           |
 | `device_type` | Can be either `desktop` (default) or `mobile`. This is equivalent to setting ScrapingBees's `device`.                                                                                                                                                                                                                         |
 | `binary_target` | Specify whether the target is a file. Can be `true` or `false`, default is `false`. Currently only supported when JS rendering is set to `false` via the `render_js`, `browser`, or `render` parameters.                                                                                                                      |
 

src/const.ts

@@ -19,3 +19,10 @@ export const VALID_RESOURCES = [
     'manifest',
     'other',
 ];
+
+// Headers that authenticate the caller to this Actor. Forwarding them to the scraped
+// website would hand the caller's Apify API token to that website's operator.
+export const CREDENTIAL_HEADERS = [
+    'authorization',
+    'proxy-authorization',
+];

src/utils.ts

@@ -10,7 +10,7 @@ import { EquivalentParameters, ScrapingBee, ScraperApi, ScrapingAnt } from './pa
 import { UserInputError } from './errors.js';
 import { validateAndTransformExtractRules } from './extract_rules_utils.js';
 import { parseAndValidateInstructions } from './instructions_utils.js';
-import { Label, VALID_RESOURCES } from './const.js';
+import { CREDENTIAL_HEADERS, Label, VALID_RESOURCES } from './const.js';
 
 const transformTimeMeasuresToRelative = (timeMeasures: TimeMeasure[]): TimeMeasure[] => {
     const firstMeasure = timeMeasures[0].time;
@@ -268,6 +268,9 @@ export function createRequestForCrawler(params: ParsedUrlQuery, req: IncomingMes
         const reqHeaders = req.headers;
         const headersToForward: Record<string, string> = {};
         for (const [key, val] of Object.entries(reqHeaders)) {
+            if (CREDENTIAL_HEADERS.includes(key.toLowerCase())) {
+                continue;
+            }
             if (Array.isArray(val)) {
                 continue;
             }