[PR #98] [MERGED] fix: add request validation to dev server #308

New issue

Closed

opened 2026-05-06 12:39:06 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-06 12:39:06 +02:00

Owner

📋 Pull Request Information

Original PR: https://github.com/cloudflare/vinext/pull/98
Author: @southpolesteve
Created: 2/26/2026
Status: ✅ Merged
Merged: 2/26/2026
Merged by: @southpolesteve

Base: main ← Head: fix/dev-server-validation

📝 Commits (1)

acb5407 fix: add request validation to dev server

📊 Changes

15 files changed (+713 additions, -27 deletions)

View changed files

📝 examples/hackernews/worker/index.ts (+4 -2)
📝 examples/pages-router-cloudflare/worker/index.ts (+6 -0)
📝 examples/realworld-api-rest/worker/index.ts (+6 -0)
📝 packages/vinext/src/deploy.ts (+8 -4)
📝 packages/vinext/src/index.ts (+49 -7)
📝 packages/vinext/src/server/app-dev-server.ts (+26 -5)
📝 packages/vinext/src/server/app-router-entry.ts (+4 -2)
➕ packages/vinext/src/server/dev-origin-check.ts (+180 -0)
📝 packages/vinext/src/server/image-optimization.ts (+19 -5)
📝 packages/vinext/src/server/prod-server.ts (+6 -2)
📝 tests/app-router.test.ts (+85 -0)
📝 tests/deploy.test.ts (+13 -0)
➕ tests/dev-origin-check.test.ts (+189 -0)
📝 tests/pages-router.test.ts (+60 -0)
📝 tests/shims.test.ts (+58 -0)

📄 Description

Summary

Adds origin verification for non-localhost requests and fixes URL sanitization in the image optimization redirect to handle backslash characters.

Cross-origin protection: New dev-origin-check.ts module validates request origins against localhost, [::1], 127.0.0.1, *.localhost subdomains, the Host header, and a configurable allowedDevOrigins list. Also checks Sec-Fetch-Site/Sec-Fetch-Mode headers. Applied to both Pages Router (connect middleware) and App Router (generated RSC entry).
Backslash normalization: All protocol-relative URL guards now normalize \ to / before checking for //. Browsers and the URL constructor treat /\ as //, so /\evil.com would bypass a naive // check. Applied across all entry points: dev servers, prod servers, worker entries, and image optimization.
Image optimization defense-in-depth: After URL construction, validates the resolved origin hasn't changed from the base origin.
CORS config: Explicitly sets Vite's CORS origin to localhost patterns when enabling preflightContinue, preventing unintended wildcard CORS.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/cloudflare/vinext/pull/98 **Author:** [@southpolesteve](https://github.com/southpolesteve) **Created:** 2/26/2026 **Status:** ✅ Merged **Merged:** 2/26/2026 **Merged by:** [@southpolesteve](https://github.com/southpolesteve) **Base:** `main` ← **Head:** `fix/dev-server-validation` --- ### 📝 Commits (1) - [`acb5407`](https://github.com/cloudflare/vinext/commit/acb54074c5724ed2baaeacaf986e3749fd2233fa) fix: add request validation to dev server ### 📊 Changes **15 files changed** (+713 additions, -27 deletions) <details> <summary>View changed files</summary> 📝 `examples/hackernews/worker/index.ts` (+4 -2) 📝 `examples/pages-router-cloudflare/worker/index.ts` (+6 -0) 📝 `examples/realworld-api-rest/worker/index.ts` (+6 -0) 📝 `packages/vinext/src/deploy.ts` (+8 -4) 📝 `packages/vinext/src/index.ts` (+49 -7) 📝 `packages/vinext/src/server/app-dev-server.ts` (+26 -5) 📝 `packages/vinext/src/server/app-router-entry.ts` (+4 -2) ➕ `packages/vinext/src/server/dev-origin-check.ts` (+180 -0) 📝 `packages/vinext/src/server/image-optimization.ts` (+19 -5) 📝 `packages/vinext/src/server/prod-server.ts` (+6 -2) 📝 `tests/app-router.test.ts` (+85 -0) 📝 `tests/deploy.test.ts` (+13 -0) ➕ `tests/dev-origin-check.test.ts` (+189 -0) 📝 `tests/pages-router.test.ts` (+60 -0) 📝 `tests/shims.test.ts` (+58 -0) </details> ### 📄 Description ## Summary Adds origin verification for non-localhost requests and fixes URL sanitization in the image optimization redirect to handle backslash characters. - **Cross-origin protection**: New `dev-origin-check.ts` module validates request origins against localhost, `[::1]`, `127.0.0.1`, `*.localhost` subdomains, the Host header, and a configurable `allowedDevOrigins` list. Also checks `Sec-Fetch-Site`/`Sec-Fetch-Mode` headers. Applied to both Pages Router (connect middleware) and App Router (generated RSC entry). - **Backslash normalization**: All protocol-relative URL guards now normalize `\` to `/` before checking for `//`. Browsers and the URL constructor treat `/\` as `//`, so `/\evil.com` would bypass a naive `//` check. Applied across all entry points: dev servers, prod servers, worker entries, and image optimization. - **Image optimization defense-in-depth**: After URL construction, validates the resolved origin hasn't changed from the base origin. - **CORS config**: Explicitly sets Vite's CORS `origin` to localhost patterns when enabling `preflightContinue`, preventing unintended wildcard CORS. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>