GeezerVison

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 7, 2026 11:55pm

PR Summary

Medium Risk
Changes default headers on every API block request, which can alter behavior with strict WAFs or providers that expected the old browser fingerprint; user overrides remain unchanged.

Overview
Outbound HTTP/API block requests no longer send a Chrome User-Agent, Referer, or Sec-Ch-Ua* client hints by default. Defaults now use Sim/1.0 (+https://sim.ai) plus standard accept/cache/connection headers and dynamic Host, so integrations (e.g. Atlassian Jira) are less likely to fail CSRF checks triggered by browser-like fingerprints.

Tests assert the new defaults, that Referer is absent unless the user sets it, and that custom headers still override defaults. Shared test mocks in tool-tester.builder match the same header set.

^{Reviewed by Cursor Bugbot for commit 326ae91. Configure here.}

Greptile Summary

This PR removes browser-fingerprint headers (User-Agent impersonating Chrome, Referer, Sec-Ch-Ua*) from all outbound API block requests and replaces the UA with an honest Sim/1.0 (+https://sim.ai) identifier, resolving 403 CSRF failures against providers like Atlassian Jira Cloud.

• apps/sim/tools/http/utils.ts: Strips four browser-fingerprint headers from getDefaultHeaders, removes the now-unused getBaseUrl import, and adds a JSDoc comment explaining the rationale with a link to Atlassian's KB article.
• apps/sim/tools/http/request.test.ts: Replaces old window-mock boilerplate with targeted assertions verifying the new UA string, confirming absent browser headers, and adding a new test for user-supplied Referer override.
• packages/testing/src/builders/tool-tester.builder.ts: Syncs createMockHeaders to mirror the new getDefaultHeaders defaults, eliminating a pre-existing drift where Referer was hardcoded to https://www.sim.ai in tests but dynamic in production.

Confidence Score: 5/5

Safe to merge — the change removes outbound headers that were actively causing request failures and replaces them with a correct server-to-server identity. User-supplied headers continue to override defaults unchanged.

The diff is minimal and surgical: four hardcoded browser-fingerprint headers are deleted from getDefaultHeaders, the unused getBaseUrl import is cleaned up, and tests are updated to match. No auth logic, no data paths, and no API contracts are affected. The test suite was extended with explicit coverage for the new UA value and the absence of removed headers.

No files require special attention.

Important Files Changed

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant U as User / Workflow
    participant AB as API Block
    participant GDH as getDefaultHeaders()
    participant T as Target API (e.g. Jira)

    U->>AB: Execute HTTP request
    AB->>GDH: getDefaultHeaders(customHeaders, url)
    Note over GDH: Before: User-Agent = Chrome 135<br/>Referer = sim.ai<br/>Sec-Ch-Ua* = Chromium v91
    Note over GDH: After: User-Agent = Sim/1.0 (+https://sim.ai)<br/>No Referer, no Sec-Ch-Ua*
    GDH-->>AB: "{ User-Agent, Accept, Accept-Encoding, Cache-Control, Connection, Host, ...customHeaders }"
    AB->>T: "fetch(url, { headers })"
    alt Before fix
        T-->>AB: 403 XSRF check failed
    else After fix
        T-->>AB: 201 Created
    end
    AB-->>U: Response

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant U as User / Workflow
    participant AB as API Block
    participant GDH as getDefaultHeaders()
    participant T as Target API (e.g. Jira)

    U->>AB: Execute HTTP request
    AB->>GDH: getDefaultHeaders(customHeaders, url)
    Note over GDH: Before: User-Agent = Chrome 135<br/>Referer = sim.ai<br/>Sec-Ch-Ua* = Chromium v91
    Note over GDH: After: User-Agent = Sim/1.0 (+https://sim.ai)<br/>No Referer, no Sec-Ch-Ua*
    GDH-->>AB: "{ User-Agent, Accept, Accept-Encoding, Cache-Control, Connection, Host, ...customHeaders }"
    AB->>T: "fetch(url, { headers })"
    alt Before fix
        T-->>AB: 403 XSRF check failed
    else After fix
        T-->>AB: 201 Created
    end
    AB-->>U: Response

_{Reviews (2): Last reviewed commit: "fix(testing): sync shared tool-tester mo..." | Re-trigger Greptile}

@greptileai review

@cursor review