copy_safe_request() sheds unrecognized but safe HTTP headers #325

New Issue

MrUnknownDE · 2026-04-05T16:25:58+02:00

MrUnknownDE commented

2026-04-05 16:25:58 +02:00

Originally created by @jeremystretch on 2/18/2026

NetBox Edition

NetBox Community

NetBox Version

v4.5.3

Python Version

3.12

Steps to Reproduce

This was originally raised under netboxlabs/netbox-branching#434 but represents a limitation in NetBox core.

Our copy_safe_request() utility function responsible for creating pickle-safe copies of HTTP requests (e.g. for background jobs) replicates only the META values defined in HTTP_REQUEST_META_SAFE_COPY. Thus, arbitrary headers such as X-NetBox-Branch (used by netbox-branching to indicate the active branch) are discarded.

Expected Behavior

Arbitrary but safe HTTP headers (e.g. X-NetBox-Branch) should be copied to the resulting request. Presumably, we could allow all HTTP headers (META keys beginning with HTTP_) that are 1) strings and 2) not known to convey sensitive data (e.g. Authorization or Cookie).

Alternatively, we could introduce a configuration parameter to whitelist known-safe headers administratively.

Observed Behavior

Only the HTTP headers included in HTTP_REQUEST_META_SAFE_COPY are preserved.

*Originally created by @jeremystretch on 2/18/2026* ### NetBox Edition NetBox Community ### NetBox Version v4.5.3 ### Python Version 3.12 ### Steps to Reproduce This was originally raised under netboxlabs/netbox-branching#434 but represents a limitation in NetBox core. Our `copy_safe_request()` utility function responsible for creating pickle-safe copies of HTTP requests (e.g. for background jobs) replicates only the META values defined in [`HTTP_REQUEST_META_SAFE_COPY`](https://github.com/netbox-community/netbox/blob/7300104cea5d658324b9aba4873e9b867de0b9c1/netbox/utilities/constants.py#L41). Thus, arbitrary headers such as `X-NetBox-Branch` (used by netbox-branching to indicate the active branch) are discarded. ### Expected Behavior Arbitrary but safe HTTP headers (e.g. `X-NetBox-Branch`) should be copied to the resulting request. Presumably, we could allow all HTTP headers (`META` keys beginning with `HTTP_`) that are 1) strings and 2) not known to convey sensitive data (e.g. `Authorization` or `Cookie`). Alternatively, we could introduce a configuration parameter to whitelist known-safe headers administratively. ### Observed Behavior Only the HTTP headers included in `HTTP_REQUEST_META_SAFE_COPY` are preserved.

MrUnknownDE closed this issue

2026-04-05 16:25:58 +02:00

Sign in to join this conversation.

Branches Tags

main

21455-sql-indexes-audit

21357-register-model-actions

feature

20924-plugin-ui-components

21766-improve-test-coverage-for-sortable-table-columns

21157-export-template-public-models

21025-pre-render-config-contexts

21364-swagger

feature-ip-prefix-link

20911-dropdown-3

fix_module_substitution

21160-filterset

20911-dropdown-2

20044-elevation-stuck-lightmode

7604-filter-modifiers-v3

20660-script-load

19724-graphql

14884-script

19720-macaddress-interface-generic-relation

fix-19669-api-image-download

7604-filter-modifiers

19275-fixes-interface-bulk-edit

fix-17794-get_field_value_return_list

11507-show-aggregate-and-rir-on-api

9583-add_column_specific_search_field_to_tables

No Label netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox severity: low severity: low severity: low severity: low severity: low severity: low severity: low severity: low severity: low severity: low severity: low severity: low severity: low severity: low severity: low severity: low severity: low severity: low severity: low severity: low severity: low severity: low severity: low severity: low severity: low severity: low severity: low severity: low severity: low severity: low severity: low status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/netbox#325

copy_safe_request() sheds unrecognized but safe HTTP headers #325