[PR #290] [MERGED] Merge middleware response headers on all App Router response paths #449

New issue

Closed

opened 2026-05-06 12:39:51 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-06 12:39:51 +02:00

Owner

📋 Pull Request Information

Original PR: https://github.com/cloudflare/vinext/pull/290
Author: @southpolesteve
Created: 3/6/2026
Status: ✅ Merged
Merged: 3/6/2026
Merged by: @southpolesteve

Base: main ← Head: fix/merge-middleware-headers-all-paths

📝 Commits (2)

05c8375 Merge middleware response headers on all App Router response paths
d4b2693 Replace module-level middleware state with per-request container

📊 Changes

2 files changed (+42 additions, -39 deletions)

View changed files

📝 packages/vinext/src/server/app-dev-server.ts (+41 -38)
📝 tests/app-router.test.ts (+1 -1)

📄 Description

Summary

Middleware response headers (Set-Cookie, CORS headers, custom headers, etc.) were only being merged into RSC streaming responses and HTML rendering responses. They were dropped on route handlers, server actions, metadata routes, image optimization, error pages, and most other response paths (roughly 30 out of 37 return points in _handleRequest()).
Moved middleware header merging from individual per-path merge points to the handler() wrapper function, which runs after _handleRequest() returns. This ensures all response paths (except early redirects/errors before middleware runs) receive middleware headers.

Changes

packages/vinext/src/server/app-dev-server.ts:
- Lifted _middlewareResponseHeaders and _middlewareRewriteStatus to module-level variables (__pendingMiddlewareHeaders, __pendingMiddlewareRewriteStatus) so the handler wrapper can access them.
- Added centralized middleware header merge in handler() after _handleRequest() returns, using response.headers.append() to preserve existing header values.
- Removed the two redundant per-path merges (RSC response path and attachMiddlewareContext()) to prevent header duplication.
- Reset module-level variables at the start of each request.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/cloudflare/vinext/pull/290 **Author:** [@southpolesteve](https://github.com/southpolesteve) **Created:** 3/6/2026 **Status:** ✅ Merged **Merged:** 3/6/2026 **Merged by:** [@southpolesteve](https://github.com/southpolesteve) **Base:** `main` ← **Head:** `fix/merge-middleware-headers-all-paths` --- ### 📝 Commits (2) - [`05c8375`](https://github.com/cloudflare/vinext/commit/05c8375698a9765e3f65bdba50538ba4e4a7db1e) Merge middleware response headers on all App Router response paths - [`d4b2693`](https://github.com/cloudflare/vinext/commit/d4b2693f1bec0cac34f65d443f9fd066ed12ee04) Replace module-level middleware state with per-request container ### 📊 Changes **2 files changed** (+42 additions, -39 deletions) <details> <summary>View changed files</summary> 📝 `packages/vinext/src/server/app-dev-server.ts` (+41 -38) 📝 `tests/app-router.test.ts` (+1 -1) </details> ### 📄 Description ## Summary - Middleware response headers (Set-Cookie, CORS headers, custom headers, etc.) were only being merged into RSC streaming responses and HTML rendering responses. They were dropped on route handlers, server actions, metadata routes, image optimization, error pages, and most other response paths (roughly 30 out of 37 return points in `_handleRequest()`). - Moved middleware header merging from individual per-path merge points to the `handler()` wrapper function, which runs after `_handleRequest()` returns. This ensures all response paths (except early redirects/errors before middleware runs) receive middleware headers. ## Changes - `packages/vinext/src/server/app-dev-server.ts`: - Lifted `_middlewareResponseHeaders` and `_middlewareRewriteStatus` to module-level variables (`__pendingMiddlewareHeaders`, `__pendingMiddlewareRewriteStatus`) so the handler wrapper can access them. - Added centralized middleware header merge in `handler()` after `_handleRequest()` returns, using `response.headers.append()` to preserve existing header values. - Removed the two redundant per-path merges (RSC response path and `attachMiddlewareContext()`) to prevent header duplication. - Reset module-level variables at the start of each request. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>