fix: normalize HTTP headers (#858)

Lowercase all header names in request options of http.js and improve resilience against no headers existing

Author: Regalijan

lib/util/http.js

@@ -37,6 +37,11 @@ request = request.defaults({
 **/
 
 function http (url, opt) {
+  if (opt?.headers) {
+    opt.headers = Object.fromEntries(
+      Object.entries(opt.headers).map(([k, v]) => [k.toLowerCase(), v])
+    )
+  }
   if (opt && !opt.jar && Object.keys(opt).indexOf('jar') > -1) {
     opt.jar = options.jar
   }
@@ -82,26 +87,24 @@ exports.func = function (args) {
     return follow
   }
   return http(args.url, opt).then(function (res) {
-    if (opt && opt.headers && opt.headers['X-CSRF-TOKEN']) {
-      if (res.statusCode === 403 && res.headers['X-CSRF-TOKEN']) {
-        if (depth >= 2) {
-          throw new Error('Tried ' + (depth + 1) + ' times and could not refresh XCSRF token successfully')
-        }
+    if (res.statusCode === 403 && res.headers['x-csrf-token'] && Object.hasOwn(opt.headers ?? {}, 'x-csrf-token')) {
+      if (depth >= 2) {
+        throw new Error('Tried ' + (depth + 1) + ' times and could not refresh XCSRF token successfully')
+      }
 
-        const token = res.headers['x-csrf-token']
+      const token = res.headers['x-csrf-token']
 
-        if (token) {
-          opt.headers['X-CSRF-TOKEN'] = token
-          opt.jar = jar
-          args.depth = depth + 1
-          return exports.func(args)
-        } else {
-          throw new Error('Could not refresh X-CSRF-TOKEN')
-        }
+      if (token) {
+        opt.headers['x-csrf-token'] = token
+        opt.jar = jar
+        args.depth = depth + 1
+        return exports.func(args)
       } else {
-        if (depth > 0) {
-          cache.add(options.cache, 'XCSRF', getHash({ jar }), opt.headers['X-CSRF-TOKEN'])
-        }
+        throw new Error('Could not refresh X-CSRF-TOKEN')
+      }
+    } else {
+      if (depth > 0) {
+        cache.add(options.cache, 'XCSRF', getHash({ jar }), opt.headers['x-csrf-token'])
       }
     }
     if (res.statusCode === 302 && !args.ignoreLoginError && res.headers.location && (res.headers.location.startsWith('https://www.roblox.com/newlogin') || res.headers.location.startsWith('/Login/Default.aspx'))) {