Endpoint with query parameter named callback

General
1

I'm currently migrating some old stuff to node-red. One of the legacy API that I'm migrating is simple like this:

Method: GET
URL: /sampleendpoint

The response is a formatted JSON object like this:

{
    "type": "test",
    "success": true
}

The issue that I can't resolve is when the caller passes a query parameter named "callback". Node-red is adding some function inside the response payload that I'm returning as a final message. This only happens if the query parameter is named "callback".

Here's a sample curl to show the message I'm getting:

curl --location 'http://127.0.0.1:1880/sampleendpoint?callback=https%3A%2F%2Fgoogle.com'

The response I'm getting if I have this query parameter named "callback" is this:

/**/ typeof httpsgoogle.com === 'function' && httpsgoogle.com({"type":"test","success":true});

Is this a known bug? anything that I can do to turn this off?

2

looks like a bug, I am sure the node maintainers will clarify if it is and is know . If it is I would raise an issue to the github repo.

You can work around it by using a change node to move msg.req.query.callback to another property maybe msg.req.query._callback before it gets to the response node.

3

I tried your suggestion and it actually worked! appreciate the suggestion, never thought of this kind of approach.