[Critical] apiFetch headers spread overwrites Content-Type when custom headers passed #38

New issue

Closed

opened 2026-05-24 14:05:02 -04:00 by zgaetano · 0 comments

zgaetano commented

2026-05-24 14:05:02 -04:00

Owner

File: data.jsx:17-22, also js/api.js:14-21
Severity: Critical

...opts is spread AFTER headers, so any caller that passes custom headers in opts replaces the entire Content-Type header instead of extending it. Not triggered yet but will break the first time auth tokens or custom headers are added.

Fix: Move ...opts before headers, or use { ...opts, headers: { 'Content-Type': 'application/json', ...(opts.headers || {}) } }.

**File:** data.jsx:17-22, also js/api.js:14-21 **Severity:** Critical ...opts is spread AFTER headers, so any caller that passes custom headers in opts replaces the entire Content-Type header instead of extending it. Not triggered yet but will break the first time auth tokens or custom headers are added. **Fix:** Move ...opts before headers, or use { ...opts, headers: { 'Content-Type': 'application/json', ...(opts.headers || {}) } }.