Hostname/IP does not match certificate's altnames

[tbontb-iaq]

I want to write a simple backend program using express and node-fetch to help my website bypass same-origin policy.

It looks like below:

import express from "express";
import fetch from "node-fetch";

const app = express();

app.get("/api/get", (req, res) => {
  const url = req.query["url"];
  if (typeof url === "string")
    fetch(url, {
      headers: req.headers as Record<string, string>,
    })
      .then((r) => {
        // do something
      })
      .catch((e) => {
        // do something
      });
  else {
    // do something
  }
});

export const handler = app;

I wanted it to be as transparent as possible, so I passed the request headers as-is to the target site. However the following error occurs:

FetchError: request to https://api.zhihu.com/answers/2766840535 failed, reason: Hostname/IP does not match certificate's altnames: Host: api.zhihu.com. is not in the cert's altnames: DNS:*.cdn.myqcloud.com, DNS:*.2144.cn, DNS:*.2144.com, DNS:*.4399.com, DNS:*.5054399.com, DNS:*.58cdn.com.cn, DNS:*.danmu.com, DNS:*.dpfile.com, DNS:*.ffnews.cn, DNS:*.file.myqcloud.com, DNS:*.flash.2144.com, DNS:*.flash.cn, DNS:*.image.myqcloud.com, DNS:*.img4399.com, DNS:*.sogoucdn.com, DNS:*.uniqlo.cn, DNS:*.vip.cdngot.com, DNS:*.vod.myqcloud.com, DNS:*.vod2.myqcloud.com, DNS:*.wanyabox.com, DNS:*.zhongcheng818.com, DNS:cdn.myqcloud.com, DNS:nitrome.com.4399.com, DNS:www.miniclip.com.4399pk.com

The request url made by my website is http://localhost:5173/api/get?url=https%3A%2F%2Fapi.zhihu.com%2Fanswers%2F2766840535, its header is:

{
  host: 'localhost:5173',
  connection: 'keep-alive',
  'user-agent': 'Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1',
  accept: '*/*',
  'sec-fetch-site': 'same-origin',
  'sec-fetch-mode': 'cors',
  'sec-fetch-dest': 'empty',
  referer: 'http://localhost:5173/answer/2767440768',
  'accept-encoding': 'gzip, deflate, br',
  'accept-language': 'zh-CN,zh;q=0.9',
  cookie: 'xxx',
  'if-none-match': 'W/"4b0-/EkzfWBxtnLcu9kht55blTTaH9k"'
}

When I removed the line where headers: req.headers as Record<string, string> was, and no longer tried to send the request headers, this error disappeared.

Another solution is to modify the host value before sending the request header: req.headers.host = "api.zhihu.com";, but the target site returned unexpected results.

How can i resolve the error in case of sending request headers?

[tbontb-iaq]

Forgive my stupid question. Remove the host field and referer field before sending the request header.

import express from "express";
import fetch from "node-fetch";

const app = express();

app.get("/api/get", (req, res) => {
  const url = req.query["url"];
  delete req.headers.host;
  delete req.headers.referer;
  if (typeof url === "string")
    fetch(url, {
      headers: req.headers as Record<string, string>,
    })
      .then((r) => {
        // do something
      })
      .catch((e) => {
        // do something
      });
  else {
    // do something
  }
});

export const handler = app;

[marian-gheorghe]

Why did you consider your question stupid? Your answer helped me fix my issue as well, but why do we have to delete the host header in the first place? This doesn't make sense to me. Maybe someone could help clear this up?

[marian-gheorghe]

Ok, found the origin of this problem: nodejs/node#37104

[victors1681]

I was doing the same in NextJS API Router, passing down the whole header object! thank you for posing this!! @tbontb-iaq

[tbontb-iaq]

You are welcome. Glad to be able to help you.

[ahmdadl]

@tbontb-iaq thanks bro, fixed my issue.