[PR #362] [MERGED] fix: guard dev-origin check with NODE_ENV to prevent 403s in production #512

New issue

Closed

opened 2026-05-06 13:08:28 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-06 13:08:28 +02:00

Owner

📋 Pull Request Information

Original PR: https://github.com/cloudflare/vinext/pull/362
Author: @Divkix
Created: 3/9/2026
Status: ✅ Merged
Merged: 3/9/2026
Merged by: @james-elicx

Base: main ← Head: fix/dev-origin-check-production-guard

📝 Commits (1)

5e2dc20 fix: guard dev-origin check with NODE_ENV to prevent 403s in production

📊 Changes

2 files changed (+42 additions, -21 deletions)

View changed files

📝 packages/vinext/src/server/app-dev-server.ts (+6 -3)
📝 tests/__snapshots__/entry-templates.test.ts.snap (+36 -18)

📄 Description

Summary

Wraps the __validateDevRequestOrigin() call in the generated App Router RSC entry with a process.env.NODE_ENV !== "production" guard
Prevents legitimate cross-origin requests from being blocked with 403 Forbidden when deployed to Cloudflare Workers
Vite statically replaces NODE_ENV at build time, so the entire block becomes dead code in production builds

Closes #361

Test plan

pnpm test tests/dev-origin-check.test.ts — 28 tests pass (function behavior unchanged)
pnpm test tests/entry-templates.test.ts — 10 tests pass (snapshots updated)
pnpm run typecheck — clean
pnpm run lint — clean

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/cloudflare/vinext/pull/362 **Author:** [@Divkix](https://github.com/Divkix) **Created:** 3/9/2026 **Status:** ✅ Merged **Merged:** 3/9/2026 **Merged by:** [@james-elicx](https://github.com/james-elicx) **Base:** `main` ← **Head:** `fix/dev-origin-check-production-guard` --- ### 📝 Commits (1) - [`5e2dc20`](https://github.com/cloudflare/vinext/commit/5e2dc2030d8dca6f5efd58ddea291cbd14ed975b) fix: guard dev-origin check with NODE_ENV to prevent 403s in production ### 📊 Changes **2 files changed** (+42 additions, -21 deletions) <details> <summary>View changed files</summary> 📝 `packages/vinext/src/server/app-dev-server.ts` (+6 -3) 📝 `tests/__snapshots__/entry-templates.test.ts.snap` (+36 -18) </details> ### 📄 Description ## Summary - Wraps the `__validateDevRequestOrigin()` call in the generated App Router RSC entry with a `process.env.NODE_ENV !== "production"` guard - Prevents legitimate cross-origin requests from being blocked with 403 Forbidden when deployed to Cloudflare Workers - Vite statically replaces `NODE_ENV` at build time, so the entire block becomes dead code in production builds Closes #361 ## Test plan - [x] `pnpm test tests/dev-origin-check.test.ts` — 28 tests pass (function behavior unchanged) - [x] `pnpm test tests/entry-templates.test.ts` — 10 tests pass (snapshots updated) - [x] `pnpm run typecheck` — clean - [x] `pnpm run lint` — clean --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>