Parse.query() raises`Uncaught (in promise) Error: Failed to execute 'has' on 'Headers': Invalid name`

[Niccari]

New Issue Checklist

• I am not disclosing a vulnerability.
• I am not just asking a question.
• I have searched through existing issues.
• I can reproduce the issue with the latest versions of Parse Server and the Parse JS SDK.

Issue Description

If any of the Parse.find queries are executed, an Uncaught (in promise) Error: Failed to execute 'has' on 'Headers': Invalid name exception is raised when the request is received.

Steps to reproduce

1. Fetch a parse.min.js

    <script type="text/javascript" src="https://unpkg.com/parse/dist/parse.min.js"></script>

2. Initialization

  Parse.initialize(id, token);
  Parse.serverURL = 'https://parseapi.back4app.com/';

3. Run a query

    const refQuery = new Parse.Query(SomeSchemaName);
    refQuery
      .equalTo('someParam', someParamValue).limit(1000);
      .find() // without `find()` or any filter, the error be raised too
      .then((results) => {
        // ...
      })
      .catch((error) => {
        // The error will be raised
      });

Actual Outcome

Uncaught (in promise) Error: Failed to execute 'has' on 'Headers': Invalid name thrown at the below header check.

Parse-SDK-JS/src/RESTController.ts

Line 161 in 7bec0fd

if (response.headers.has(header)) {

Expected Outcome

Query result will be retrieved.

Environment

Server

• Parse Server version: 6.2.0
• Operating system: not disclosed
• Local or remote host (AWS, Azure, Google Cloud, Heroku, Digital Ocean, etc): Back4App

Database

• System (MongoDB or Postgres): MongoDB
• Database version: 3.6.0
• Local or remote host (MongoDB Atlas, mLab, AWS, Azure, Google Cloud, etc): Back4App

Client

• Parse JS SDK version: 7.0.0
• Chrome Version 141.0.7390.108 (Official Build) (arm64)
• MacOS 26.0.1

Logs

Parse server response

Client debug log

[parse-github-assistant]

🚀 Thanks for opening this issue!

ℹ️ You can help us to fix this issue faster by opening a pull request with a failing test. See our Contribution Guide for how to make a pull request, or read our New Contributor's Guide if this is your first time contributing.

[mtrezza]

@Niccari Could you help me understand where the issue comes from? What has changed that is causing this error? I wonder why none of the existing tests in the JS SDK or Parse Server where we just upgraded to Parse JS SDK 7.0.1 have detected this issue?

[Niccari]

@Niccari Could you help me understand where the issue comes from? What has changed that is causing this error? I wonder why none of the existing tests in the JS SDK or Parse Server where we just upgraded to Parse JS SDK 7.0.1 have detected this issue?

The error is caused by a difference in behavior between XMLHttpRequest.getRequestHeader and Headers.has, which has been confirmed in both browsers and Node.js.
This issue occurs in v7.0.0 and later, but not in v6.x and earlier.

• XMLHttpRequest.getRequestHeader("") → returns null
• new Headers().has("") → throws Uncaught TypeError: Headers.has: is an invalid header name.

In the RESTController tests, the fetch API is mocked using mockFetch to simulate API request and response handling.
However, the mock implementation of headers.has(header) did not reproduce the TypeError that should occur when the argument header is an empty string ("").
As a result, calling headers.has("") in the tests did not raise an exception, and the test passed successfully.

To address this, commit 5359aa8 modified mockFetch to correctly throw an exception in this case.
After this change, we confirmed that RESTController-test.js now throws the expected TypeError and fails when the "access-control-expose-headers" header is missing.

commit_5359aa_test_log.txt

[parseplatformorg]

🎉 This change has been released in version 7.0.2-alpha.1

[parseplatformorg]

🎉 This change has been released in version 7.0.2