[BUG]: How to get all request headers

[tientq64]

What happened?

I need to get the "github-authentication-token-expiration" header, but the header returned by the octokit/rest method only includes this properties, not all the headers:

{
    'cache-control': 'private, max-age=60, s-maxage=60',
    'content-type': 'application/json; charset=utf-8',
    etag: 'W/"4414ed725cbf2c0ae084e5a7c623cfc4799ccdbb24d20e9ed6d03a6ecf53ca59"',
    'last-modified': 'Sat, 23 Nov 2024 05:09:55 GMT',
    'x-github-media-type': 'github.v3; format=json',
    'x-github-request-id': 'D8D6:329CE:2A89F1:301071:674B51F2',
    'x-ratelimit-limit': '5000',
    'x-ratelimit-remaining': '4960',
    'x-ratelimit-reset': '1732990403',
    'x-ratelimit-resource': 'core',
    'x-ratelimit-used': '40'
}

All headers:

access-control-allow-origin: *
access-control-expose-headers: ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset
cache-control: private, max-age=60, s-maxage=60
content-encoding: gzip
content-security-policy: default-src 'none'
content-type: application/json; charset=utf-8
date: Sat, 23 Nov 2024 05:09:55 GMT
etag: W/"4414ed725cbf2c0ae084e5a7c623cfc4799ccdbb24d20e9ed6d03a6ecf53ca59"
github-authentication-token-expiration: 2025-01-21 00:00:00 +0700
last-modified: Sat, 23 Nov 2024 05:09:55 GMT
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
server: github.com
strict-transport-security: max-age=31536000; includeSubdomains; preload
vary: Accept, Authorization, Cookie, X-GitHub-OTP,Accept-Encoding, Accept, X-Requested-With
x-accepted-github-permissions: contents=read
x-content-type-options: nosniff
x-frame-options: deny
x-github-api-version-selected: 2022-11-28
x-github-media-type: github.v3; format=json
x-github-request-id: D8D6:329CE:2A89F1:301071:674B51F2
x-ratelimit-limit: 5000
x-ratelimit-remaining: 4960
x-ratelimit-reset: 1732990403
x-ratelimit-resource: core
x-ratelimit-used: 40
x-xss-protection: 0

Versions

Octokit.js v20.1.1, Node v20.9.0

Relevant log output

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[github-actions]

👋 Hi! Thank you for this contribution! Just to let you know, our GitHub SDK team does a round of issue and PR reviews twice a week, every Monday and Friday! We have a process in place for prioritizing and responding to your input. Because you are a part of this community please feel free to comment, add to, or pick up any issues/PRs that are labeled with Status: Up for grabs. You & others like you are the reason all of this works! So thank you & happy coding! 🚀

[wolfy1339]

I can't reproduce this issue.

// @ts-check
import { Octokit } from "@octokit/rest";

const octokit = new Octokit({
  auth: process.env.GITHUB_TOKEN,
});

const res = await octokit.rest.users.getAuthenticated();
console.log(res.headers);

{
  'access-control-allow-origin': '*',
  'access-control-expose-headers': 'ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset',
  'cache-control': 'private, max-age=60, s-maxage=60',
  'content-encoding': 'gzip',
  'content-security-policy': "default-src 'none'",
  'content-type': 'application/json; charset=utf-8',
  date: 'Sat, 30 Nov 2024 19:14:28 GMT',
  etag: 'W/"35f3c9b017c37f82788c5692a3bc7670f9e6a889c89163aa61865baa3f7d5d88"',
  'github-authentication-token-expiration': '2024-12-30 19:12:32 UTC',
  'last-modified': 'Tue, 27 Aug 2024 21:43:23 GMT',
  'referrer-policy': 'origin-when-cross-origin, strict-origin-when-cross-origin',
  server: 'github.com',
  'strict-transport-security': 'max-age=31536000; includeSubdomains; preload',
  'transfer-encoding': 'chunked',
  vary: 'Accept, Authorization, Cookie, X-GitHub-OTP,Accept-Encoding, Accept, X-Requested-With',
  'x-accepted-oauth-scopes': '',
  'x-content-type-options': 'nosniff',
  'x-frame-options': 'deny',
  'x-github-api-version-selected': '2022-11-28',
  'x-github-media-type': 'github.v3; format=json',
  'x-github-request-id': 'CA22:2AD2:1CEA35B:395A370:674B6413',
  'x-oauth-scopes': 'read:packages, repo, user, workflow',
  'x-ratelimit-limit': '5000',
  'x-ratelimit-remaining': '4946',
  'x-ratelimit-reset': '1732995371',
  'x-ratelimit-resource': 'core',
  'x-ratelimit-used': '54',
  'x-xss-protection': '0'
}

[tientq64]

I forgot. The issue only occurs when using it on the front-end, with the back-end it works normally.

[wolfy1339]

It would have been important to say that this was a browser environment and not Node...

const f = await fetch("https://api.github.com/user",
  {
    headers: {
      authorization: `token `,
    },
  }
)
console.log(Object.fromEntries(f.headers.entries()));

    {
      cache-control: "private, max-age=60, s-maxage=60",
      content-type: "application/json; charset=utf-8",
      etag: "W/\"f70fc9d1d48252585a86bec8e6ed06695f90f8e05c644b7b545e9604c0fd9ea5\"",
      last-modified: "Tue, 27 Aug 2024 21:43:23 GMT",
      x-accepted-oauth-scopes: "",
      x-github-media-type: "github.v3; format=json",
      x-github-request-id: "9076:963C3:14C2EAC:2921D4A:675084DC",
      x-oauth-scopes: "admin:gpg_key, notifications, read:audit_log, read:discussion, read:org, read:packages, read:project, read:public_key, read:repo_hook, repo, user, workflow",
      x-ratelimit-limit: "5000",
      x-ratelimit-remaining: "4992",
      x-ratelimit-reset: "1733332978",
      x-ratelimit-resource: "core",
      x-ratelimit-used: "8"
    }

Unfortunately, there is nothing we can do. This is a bug on GitHub's backend with CORS, https://stackoverflow.com/questions/43344819/reading-response-headers-with-fetch-api/44816592#44816592

They need to add the value to the Access-Control-Allow-Headers header