how to get header after use cachedEventHandler?

[happyboy2022]

In my use of cacheEventHandler to handle HTTP events, I find myself unable to retrieve the header with the line:
const sign = getHeader(event, 'x-signature').
However, I noticed that when I switch to using defineEventHandler, I am able to obtain the header as expected.

This discrepancy led me to examine the source code of Nitro, where I found the following snippet:

const _cachedHandler = cachedFunction(
    async (incomingEvent) => {
      const reqProxy = cloneWithProxy(incomingEvent.node.req, { headers: {} });
      ...
      const event = createEvent(reqProxy, resProxy);

From the looks of it, it seems that reqProxy is designed to disregard headers. May I ask why it is designed this way? Furthermore, if I need to access the header within the event handler, how should I go about doing so?

[stafyniaksacha]

I think it's about security issue, to not respond to an event with response processed with a previous event (because it was cached). I think if you need to check headers (cookies, authorization, etc...) you should not use cached event handler

[happyboy2022]

Thank you for your response.
You're right, it indeed seems inappropriate to check headers in the cache handler.
Consequently, I have moved the logic to check headers (cookies, authorization, etc.) into the middleware, which appears to be functioning as expected.

[jwhazel]

Update: Nitro has added support for ignoring individual headers through cache options via the varies key: https://nitro.unjs.io/guide/cache#options. So in the case of the original question, the code would look like this:

cacheEventHandler(async (event) => {
    // code
}, { varies: ["x-signature"] });

The accepted answer still has good advice: think carefully about this pattern before you implement it since it could lead to unintended security issues.