From 244ec1f4a6d7c36a65e2e014dd7cc703229ddf82 Mon Sep 17 00:00:00 2001
From: WardPearce <wardpearce@pm.me>
Date: Mon, 9 Mar 2026 20:59:30 +1300
Subject: [PATCH] Pass headers to request in proxy

---
 .../routes/api/proxy/[urlToProxy]/+server.ts   | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/materialious/src/routes/api/proxy/[urlToProxy]/+server.ts b/materialious/src/routes/api/proxy/[urlToProxy]/+server.ts
index 5549cdd7..d30cec2e 100644
--- a/materialious/src/routes/api/proxy/[urlToProxy]/+server.ts
+++ b/materialious/src/routes/api/proxy/[urlToProxy]/+server.ts
@@ -100,14 +100,24 @@ async function proxyRequest(
 		}
 	}
 
-	const requestHeaders = new Headers();
+	const requestHeaders = new Headers(request.headers);
 	requestHeaders.set('host', urlToProxyObj.host);
 	requestHeaders.set('origin', urlToProxyObj.origin);
 	requestHeaders.set('user-agent', USER_AGENT);
 
-	const authHeader = request.headers.get('Authorization');
-	if (authHeader) {
-		requestHeaders.set('Authorization', authHeader);
+	// Remove headers that may cause issues or be auto-managed
+	for (const key of [
+		'referer',
+		'x-forwarded-for',
+		'x-requested-with',
+		'sec-ch-ua-mobile',
+		'sec-ch-ua',
+		'sec-ch-ua-platform',
+		'cookie', // Ensure auth cookies don't become included.
+		'content-type',
+		'content-length'
+	]) {
+		requestHeaders.delete(key);
 	}
 
 	const requestOptions: RequestInit = {