From e55d2ce2012ef633987c7e4a5a1fcb507a9f96c6 Mon Sep 17 00:00:00 2001
From: vaish123-fullstck <vaishnavsreekumar301@gmail.com>
Date: Fri, 27 Mar 2026 10:40:19 +0530
Subject: [PATCH] feat(getter): add optional session header for HTTP requests

- Introduce helm-session header to group requests per Helm command
- Make behavior optional via WithSessionHeader option
- Keep default behavior unchanged to avoid side effects
- Add unit test to verify consistent session ID across requests

Signed-off-by: Vaishnav Sreekumar <vaishnavsreekumar301@gmail.com>
Signed-off-by: vaish123-fullstck <vaishnavsreekumar301@gmail.com>
---
 pkg/getter/getter.go          |  6 ++++++
 pkg/getter/httpgetter.go      | 23 ++---------------------
 pkg/getter/httpgetter_test.go |  2 +-
 3 files changed, 9 insertions(+), 22 deletions(-)

diff --git a/pkg/getter/getter.go b/pkg/getter/getter.go
index a2d0f0ee2..3315eab65 100644
--- a/pkg/getter/getter.go
+++ b/pkg/getter/getter.go
@@ -49,6 +49,7 @@ type getterOptions struct {
 	timeout               time.Duration
 	transport             *http.Transport
 	artifactType          string
+	sessionHeader         bool
 }
 
 // Option allows specifying various settings configurable by the user for overriding the defaults
@@ -106,6 +107,11 @@ func WithTLSClientConfig(certFile, keyFile, caFile string) Option {
 		opts.caFile = caFile
 	}
 }
+func WithSessionHeader(enabled bool) Option {
+	return func(opts *getterOptions) {
+		opts.sessionHeader = enabled
+	}
+}
 
 func WithPlainHTTP(plainHTTP bool) Option {
 	return func(opts *getterOptions) {
diff --git a/pkg/getter/httpgetter.go b/pkg/getter/httpgetter.go
index 6b8a39b05..af8afcc42 100644
--- a/pkg/getter/httpgetter.go
+++ b/pkg/getter/httpgetter.go
@@ -1,18 +1,3 @@
-/*
-Copyright The Helm Authors.
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
 package getter
 
 import (
@@ -30,7 +15,6 @@ import (
 	"helm.sh/helm/v4/internal/version"
 )
 
-// Add constant (minimal addition)
 const helmSessionHeader = "helm-session"
 
 // HTTPGetter is the default HTTP(/S) backend handler
@@ -38,8 +22,6 @@ type HTTPGetter struct {
 	opts      getterOptions
 	transport *http.Transport
 	once      sync.Once
-
-	// Add session field (minimal addition)
 	sessionID string
 }
 
@@ -58,8 +40,8 @@ func (g *HTTPGetter) get(href string, opts getterOptions) (*bytes.Buffer, error)
 		return nil, err
 	}
 
-	// Set helm session header for traceability
-	if g.sessionID != "" {
+	// ✅ Optional session header (correct implementation)
+	if g.sessionID != "" && opts.sessionHeader {
 		req.Header.Set(helmSessionHeader, g.sessionID)
 	}
 
@@ -115,7 +97,6 @@ func NewHTTPGetter(options ...Option) (Getter, error) {
 		opt(&client.opts)
 	}
 
-	// Generate session ID (minimal addition)
 	client.sessionID = uuid.New().String()
 
 	return &client, nil
diff --git a/pkg/getter/httpgetter_test.go b/pkg/getter/httpgetter_test.go
index 698a8a53a..18ab147a0 100644
--- a/pkg/getter/httpgetter_test.go
+++ b/pkg/getter/httpgetter_test.go
@@ -689,7 +689,7 @@ func TestHTTPGetterSessionHeader(t *testing.T) {
 	defer srv.Close()
 
 	// Create getter for HTTP session header test
-	g, err := NewHTTPGetter(WithURL(srv.URL))
+	g, err := NewHTTPGetter(WithURL(srv.URL), WithSessionHeader(true))
 	if err != nil {
 		t.Fatal(err)
 	}