Setting Axios Header to Java Backend based on value stored in express session #5955

Hi, it's been almost a year, but how about setting the headers on axios client creation on your first line?

req.headers and Axios request headers are separate things.

req.headers are the headers from the incoming browser/request to your Express app. Updating them in Express middleware will not automatically affect the outgoing Axios request from Express to your Java backend.

Also, do not set this on a shared Axios singleton with axiosClient.defaults.headers.common['agent-id'] = ... per request. In SSR, multiple users can be handled at the same time, so a global/default header can leak one user's agent-id into another user's request.

You need a request-scoped value.

The cleanest option is to pass the value when making the request:

await axiosClient.get('/some-api', {
  headers: {
    'agent-id': req.session.agentId
  }
});

If you do not want to pass req or agentId through every API function, use Node's AsyncLocalStorage to keep request context available to your Axios interceptor.

Example:

// requestContext.js
const { AsyncLocalStorage } = require('node:async_hooks');

const requestContext = new AsyncLocalStorage();

module.exports = { requestContext };

// express app
const { requestContext } = require('./requestContext');

app.use((req, res, next) => {
  requestContext.run(
    {
      agentId: req.session?.agentId
    },
    next
  );
});

Then in your Axios module:

const axios = require('axios');
const { requestContext } = require('./requestContext');

const axiosClient = axios.create({
  baseURL: '...',
  httpsAgent: null,
  proxy: false,
  timeout: 60000
});

axiosClient.interceptors.request.use(
  config => {
    const agentId = requestContext.getStore()?.agentId;

    if (agentId) {
      if (config.headers?.set) {
        config.headers.set('agent-id', agentId);
      } else {
        config.headers = {
          ...config.headers,
          'agent-id': agentId
        };
      }
    }

    return config;
  },
  error => Promise.reject(error)
);

module.exports = axiosClient;

Now your existing API calls can stay roughly the same:

import api from 'my-api-module';

const { data = {} } = await api.someName();

As long as api.someName() is called during the same Express request async chain, the interceptor can read the current request's agentId.

So the short answer is: Axios cannot magically read req.session from a separate module. Either pass the value explicitly, create a per-request Axios/API client, or use AsyncLocalStorage for request-scoped context. Avoid global Axios header mutation for session-specific values.