Waleed 858f7d2c2c fix(api-block): stop spoofing a browser fingerprint on outbound HTTP requests (#5496) ...

* fix(api-block): stop spoofing a browser fingerprint on outbound HTTP requests

getDefaultHeaders() sent a Chrome User-Agent, a Referer pointing at Sim's
own app, and mismatched Sec-Ch-Ua client hints on every API block request.
Atlassian's Jira/Confluence Cloud REST API (and other browser-aware
anti-CSRF/bot-defense layers) reject requests carrying a browser
User-Agent with 403 "XSRF check failed", even with a valid Basic-auth
header and X-Atlassian-Token: no-check set.

Default headers now identify honestly as Sim, matching how other HTTP
clients (curl, Postman, axios) behave. User-supplied headers still
override any default.

* fix(testing): sync shared tool-tester mock headers with new defaults

createMockHeaders in the shared @sim/testing tool-tester builder still
hardcoded the old Chrome UA / Referer / Sec-Ch-Ua fallback values. It was
unreachable in current tests but would silently diverge from production
getDefaultHeaders() for any future test hitting its fallback path.

2026-07-07 16:58:13 -07:00

..

src

fix(api-block): stop spoofing a browser fingerprint on outbound HTTP requests (#5496)

2026-07-07 16:58:13 -07:00

package.json

fix(deps): upgrade vitest to ^4.1.0 to patch critical Vitest UI advisory (GHSA-5xrq-8626-4rwp) (#4837)

2026-06-01 16:11:35 -07:00

tsconfig.json

improvement(monorepo): added tsconfig package, resolved type errors in testing package (#2613)

2025-12-28 00:36:48 -08:00