Upload server.js

server.js

@@ -373,7 +373,7 @@ const REQ_HEADERS_SKIP = new Set([
 ])
 const RES_HEADERS_PASS = [
   'content-type', 'content-length', 'content-range', 'accept-ranges',
-  'cache-control', 'expires', 'last-modified', 'etag'
+  'cache-control', 'expires', 'last-modified', 'etag', 'set-cookie'
 ]
 
 app.all('/r', async (req, res) => {
@@ -444,7 +444,18 @@ app.all('/r', async (req, res) => {
           res.setHeader(h, outBuf.length);
           continue;
         }
-        const v = upstream.headers.get(h);
+        
+        let v;
+        if (h === 'set-cookie') {
+          const cookies = upstream.headers.getSetCookie ? upstream.headers.getSetCookie() : [];
+          if (cookies.length) {
+            // Strip domain from cookies so they apply to our proxy's domain
+            v = cookies.map(c => c.replace(/domain=[^;]+;?\s*/gi, ''));
+          }
+        } else {
+          v = upstream.headers.get(h);
+        }
+        
         if (v) res.setHeader(h, v);
       }
       res.setHeader('access-control-allow-origin', '*');
@@ -460,7 +471,17 @@ app.all('/r', async (req, res) => {
           continue; // fetch decompresses gzip/br, so original content-length is invalid for text/json
         }
       }
-      const v = upstream.headers.get(h)
+      
+      let v;
+      if (h === 'set-cookie') {
+        const cookies = upstream.headers.getSetCookie ? upstream.headers.getSetCookie() : [];
+        if (cookies.length) {
+          v = cookies.map(c => c.replace(/domain=[^;]+;?\s*/gi, ''));
+        }
+      } else {
+        v = upstream.headers.get(h)
+      }
+      
       if (v) res.setHeader(h, v)
     }
     res.setHeader('access-control-allow-origin', '*')
@@ -495,25 +516,26 @@ server.on('upgrade', (req, clientSocket, head) => {
       }
       
       const targetUrl = new URL(targetUrlStr);
+      
+      // Filter headers carefully
+      const proxyHeaders = {};
+      for (const h in req.headers) {
+        if (['host', 'x-forwarded-for', 'x-forwarded-proto', 'x-forwarded-host', 'cf-connecting-ip', 'cf-ray', 'cf-visitor'].includes(h.toLowerCase())) continue;
+        proxyHeaders[h] = req.headers[h];
+      }
+      
+      proxyHeaders['host'] = targetUrl.hostname;
+      proxyHeaders['origin'] = targetUrl.protocol.replace('ws', 'http') + '//' + targetUrl.hostname;
+      proxyHeaders['user-agent'] = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36';
+      
       const options = {
         port: targetUrl.port || (targetUrl.protocol === 'wss:' ? 443 : 80),
         host: targetUrl.hostname,
-        headers: Object.assign({}, req.headers), // clone headers to avoid modifying original
+        servername: targetUrl.hostname, // CRITICAL FOR SNI (Cloudflare drops without this)
+        headers: proxyHeaders,
         path: targetUrl.pathname + targetUrl.search
       };
       
-      // Clean up headers and fake origin to avoid 403 Forbidden
-      options.headers.host = targetUrl.hostname;
-      options.headers.origin = targetUrl.protocol.replace('ws', 'http') + '//' + targetUrl.hostname;
-      options.headers['user-agent'] = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36';
-      
-      delete options.headers['x-forwarded-for'];
-      delete options.headers['x-forwarded-proto'];
-      delete options.headers['x-forwarded-host'];
-      delete options.headers['cf-connecting-ip'];
-      delete options.headers['cf-ray'];
-      delete options.headers['cf-visitor'];
-      
       const proto = targetUrl.protocol === 'wss:' ? require('https') : require('http');
       const proxyReq = proto.request(options);