Don't overwrite existing Authorization headers (#5)

Podkey's fetch/XHR interceptors unconditionally set Authorization on
every outbound request, replacing whatever the page already put there.
Pages using Solid-OIDC (Authorization: DPoP <token>) have their auth
silently swapped for Podkey's NIP-98 signature — the server then
authenticates as did:nostr:<podkey-key>, doesn't match the user's
real WebID, and denies access. User gets 403 on their own pod.

Fix: before injecting NIP-98, check whether the page already set
Authorization. If yes, step aside and let the page authenticate
itself. If that auth gets a 401, the existing retry-on-401 path
still tries NIP-98 as a fallback.

Covers both fetch (options.headers across Headers/object/array shapes)
and XHR (via a setRequestHeader override that tags the request).

New hasAuthorizationHeader helper is canonical in src/auth-header-utils.js
with unit tests. The in-page scripts duplicate it because they load as
classic scripts without ESM imports.

Author: melvincarvalho

src/auth-header-utils.js

@@ -0,0 +1,34 @@
+/**
+ * Utility: detect whether a fetch-options / headers shape already carries
+ * an Authorization header. Podkey's interceptors must not overwrite an
+ * Authorization header the page already set (e.g., Solid-OIDC DPoP),
+ * otherwise the request ends up authenticated as Podkey's NIP-98 identity
+ * and ACLs reject the real user (see issue #5).
+ *
+ * Handles all three shapes `options.headers` can take per the fetch spec:
+ *   - `Headers` instance
+ *   - plain object { 'Authorization': '...' }
+ *   - array of [name, value] tuples
+ */
+export function hasAuthorizationHeader(headers) {
+  if (!headers) return false;
+
+  if (typeof Headers !== 'undefined' && headers instanceof Headers) {
+    return headers.has('authorization');
+  }
+
+  if (Array.isArray(headers)) {
+    return headers.some((entry) =>
+      Array.isArray(entry) && typeof entry[0] === 'string' &&
+      entry[0].toLowerCase() === 'authorization'
+    );
+  }
+
+  if (typeof headers === 'object') {
+    for (const key of Object.keys(headers)) {
+      if (key.toLowerCase() === 'authorization') return true;
+    }
+  }
+
+  return false;
+}

src/injected.js

@@ -12,6 +12,29 @@
   const originalFetch = window.fetch;
   const originalXHROpen = XMLHttpRequest.prototype.open;
   const originalXHRSend = XMLHttpRequest.prototype.send;
+  const originalXHRSetRequestHeader = XMLHttpRequest.prototype.setRequestHeader;
+
+  // Duplicate of src/auth-header-utils.js — keep in sync. The canonical
+  // module is imported by unit tests; this copy runs in page context where
+  // classic scripts can't use ESM imports.
+  function hasAuthorizationHeader (headers) {
+    if (!headers) return false;
+    if (typeof Headers !== 'undefined' && headers instanceof Headers) {
+      return headers.has('authorization');
+    }
+    if (Array.isArray(headers)) {
+      return headers.some((entry) =>
+        Array.isArray(entry) && typeof entry[0] === 'string' &&
+        entry[0].toLowerCase() === 'authorization'
+      );
+    }
+    if (typeof headers === 'object') {
+      for (const key of Object.keys(headers)) {
+        if (key.toLowerCase() === 'authorization') return true;
+      }
+    }
+    return false;
+  }
 
   // Helper to get auth header (will be async, but we'll handle that)
   let getAuthHeaderFn = null;
@@ -28,8 +51,14 @@
     const method = options?.method || 'GET';
     console.log('[Podkey] 🔍 fetch() intercepted:', urlString, method);
 
+    // Respect an Authorization header the page already set (e.g. Solid-OIDC
+    // DPoP). Overwriting it would re-identify the request as Podkey's NIP-98
+    // and break the page's own auth. If it fails with 401, the retry path
+    // below still injects NIP-98. See issue #5.
+    const pageSetAuth = hasAuthorizationHeader(options?.headers);
+
     // If we have the auth function, use it
-    if (authFunctionReady && getAuthHeaderFn) {
+    if (authFunctionReady && getAuthHeaderFn && !pageSetAuth) {
       console.log('[Podkey] ✅ Auth function ready, adding header...');
       const promise = (async () => {
         try {
@@ -132,16 +161,25 @@
   XMLHttpRequest.prototype.open = function (method, url, ...args) {
     this._podkeyMethod = method;
     this._podkeyUrl = url;
+    this._podkeyHasPageAuth = false;
     return originalXHROpen.apply(this, [method, url, ...args]);
   };
 
+  // Track a page-set Authorization on XHR so send() can respect it.
+  XMLHttpRequest.prototype.setRequestHeader = function (name, value) {
+    if (typeof name === 'string' && name.toLowerCase() === 'authorization') {
+      this._podkeyHasPageAuth = true;
+    }
+    return originalXHRSetRequestHeader.apply(this, arguments);
+  };
+
   XMLHttpRequest.prototype.send = function (body) {
-    if (getAuthHeaderFn && this._podkeyUrl) {
+    if (getAuthHeaderFn && this._podkeyUrl && !this._podkeyHasPageAuth) {
       (async () => {
         try {
           const authHeader = await getAuthHeaderFn(this._podkeyUrl, this._podkeyMethod, body);
           if (authHeader) {
-            this.setRequestHeader('Authorization', authHeader);
+            originalXHRSetRequestHeader.call(this, 'Authorization', authHeader);
           }
         } catch (e) {
           console.error('[Podkey] Error in XHR interceptor:', e);

src/nip98-interceptor.js

@@ -16,6 +16,29 @@
   const originalFetch = window.fetch;
   const originalXHROpen = XMLHttpRequest.prototype.open;
   const originalXHRSend = XMLHttpRequest.prototype.send;
+  const originalXHRSetRequestHeader = XMLHttpRequest.prototype.setRequestHeader;
+
+  // Duplicate of src/auth-header-utils.js — keep in sync. The canonical
+  // module is imported by unit tests; this copy runs in page context where
+  // classic scripts can't use ESM imports.
+  function hasAuthorizationHeader (headers) {
+    if (!headers) return false;
+    if (typeof Headers !== 'undefined' && headers instanceof Headers) {
+      return headers.has('authorization');
+    }
+    if (Array.isArray(headers)) {
+      return headers.some((entry) =>
+        Array.isArray(entry) && typeof entry[0] === 'string' &&
+        entry[0].toLowerCase() === 'authorization'
+      );
+    }
+    if (typeof headers === 'object') {
+      for (const key of Object.keys(headers)) {
+        if (key.toLowerCase() === 'authorization') return true;
+      }
+    }
+    return false;
+  }
 
   // Helper to get auth header from extension
   async function getNip98AuthHeader (url, method, body) {
@@ -63,23 +86,33 @@
     const method = options?.method || 'GET';
     console.log('[Podkey] 🔍 fetch() intercepted:', urlString, method);
 
-    try {
-      const authHeader = await getNip98AuthHeader(url, method, options?.body);
-      if (authHeader) {
-        options = options || {};
-        options.headers = options.headers || {};
-        if (options.headers instanceof Headers) {
-          options.headers.set('Authorization', authHeader);
-          console.log('[Podkey] ✅ Added NIP-98 auth header (Headers)');
+    // Respect an Authorization header the page already set (e.g. Solid-OIDC
+    // DPoP). Overwriting it would re-identify the request as Podkey's NIP-98
+    // and break the page's own auth. If that auth fails with 401, the retry
+    // path below will still inject NIP-98. See issue #5.
+    const pageSetAuth = hasAuthorizationHeader(options?.headers);
+
+    if (!pageSetAuth) {
+      try {
+        const authHeader = await getNip98AuthHeader(url, method, options?.body);
+        if (authHeader) {
+          options = options || {};
+          options.headers = options.headers || {};
+          if (options.headers instanceof Headers) {
+            options.headers.set('Authorization', authHeader);
+            console.log('[Podkey] ✅ Added NIP-98 auth header (Headers)');
+          } else {
+            options.headers['Authorization'] = authHeader;
+            console.log('[Podkey] ✅ Added NIP-98 auth header (object)');
+          }
         } else {
-          options.headers['Authorization'] = authHeader;
-          console.log('[Podkey] ✅ Added NIP-98 auth header (object)');
+          console.log('[Podkey] ⚠️ No auth header (will retry on 401)');
         }
-      } else {
-        console.log('[Podkey] ⚠️ No auth header (will retry on 401)');
+      } catch (error) {
+        console.error('[Podkey] Error adding NIP-98 auth:', error);
       }
-    } catch (error) {
-      console.error('[Podkey] Error adding NIP-98 auth:', error);
+    } else {
+      console.log('[Podkey] ⏭️ Page already set Authorization — skipping injection');
     }
 
     const response = await originalFetch.call(this, url, options);
@@ -118,20 +151,33 @@
   XMLHttpRequest.prototype.open = function (method, url, ...args) {
     this._podkeyMethod = method;
     this._podkeyUrl = url;
+    this._podkeyHasPageAuth = false;
     return originalXHROpen.apply(this, [method, url, ...args]);
   };
 
+  // Track page-set Authorization on XHR so we don't overwrite it in send().
+  // setRequestHeader auto-merges values per the XHR spec, but a merged
+  // "DPoP xxx, Nostr yyy" still confuses servers that branch on scheme.
+  XMLHttpRequest.prototype.setRequestHeader = function (name, value) {
+    if (typeof name === 'string' && name.toLowerCase() === 'authorization') {
+      this._podkeyHasPageAuth = true;
+    }
+    return originalXHRSetRequestHeader.apply(this, arguments);
+  };
+
   XMLHttpRequest.prototype.send = async function (body) {
-    if (this._podkeyUrl) {
+    if (this._podkeyUrl && !this._podkeyHasPageAuth) {
       try {
         const authHeader = await getNip98AuthHeader(this._podkeyUrl, this._podkeyMethod, body);
         if (authHeader) {
-          this.setRequestHeader('Authorization', authHeader);
+          originalXHRSetRequestHeader.call(this, 'Authorization', authHeader);
           console.log('[Podkey] ✅ Added NIP-98 auth to XHR');
         }
       } catch (error) {
         console.error('[Podkey] Error adding NIP-98 auth to XHR:', error);
       }
+    } else if (this._podkeyHasPageAuth) {
+      console.log('[Podkey] ⏭️ Page set XHR Authorization — skipping injection');
     }
     return originalXHRSend.apply(this, [body]);
   };

test/auth-header-utils.test.js

@@ -0,0 +1,53 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert';
+import { hasAuthorizationHeader } from '../src/auth-header-utils.js';
+
+describe('hasAuthorizationHeader (#5)', () => {
+  it('returns false for undefined / empty', () => {
+    assert.strictEqual(hasAuthorizationHeader(undefined), false);
+    assert.strictEqual(hasAuthorizationHeader(null), false);
+    assert.strictEqual(hasAuthorizationHeader({}), false);
+  });
+
+  it('detects plain-object Authorization (exact case)', () => {
+    assert.strictEqual(hasAuthorizationHeader({ Authorization: 'DPoP xxx' }), true);
+  });
+
+  it('detects plain-object authorization case-insensitively', () => {
+    assert.strictEqual(hasAuthorizationHeader({ authorization: 'DPoP xxx' }), true);
+    assert.strictEqual(hasAuthorizationHeader({ AUTHORIZATION: 'DPoP xxx' }), true);
+    assert.strictEqual(hasAuthorizationHeader({ aUtHoRiZaTiOn: 'DPoP xxx' }), true);
+  });
+
+  it('returns false when plain object has unrelated headers', () => {
+    assert.strictEqual(
+      hasAuthorizationHeader({ 'Content-Type': 'application/json', 'X-Foo': 'bar' }),
+      false
+    );
+  });
+
+  it('detects Headers instance (case-insensitive per spec)', () => {
+    const h = new Headers();
+    h.set('Authorization', 'DPoP xxx');
+    assert.strictEqual(hasAuthorizationHeader(h), true);
+    assert.strictEqual(hasAuthorizationHeader(new Headers()), false);
+  });
+
+  it('detects array-of-tuples shape', () => {
+    assert.strictEqual(
+      hasAuthorizationHeader([['Content-Type', 'application/json'], ['authorization', 'Bearer x']]),
+      true
+    );
+    assert.strictEqual(
+      hasAuthorizationHeader([['Content-Type', 'application/json']]),
+      false
+    );
+  });
+
+  it('does not false-positive on header names that merely contain "authorization"', () => {
+    assert.strictEqual(
+      hasAuthorizationHeader({ 'X-Authorization-Source': 'podkey' }),
+      false
+    );
+  });
+});