[PR #418] [MERGED] docs/runtime: warn on external rewrites, sanitize Content-Disposition #558

New issue

Closed

opened 2026-05-06 13:08:45 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-06 13:08:45 +02:00

Owner

📋 Pull Request Information

Original PR: https://github.com/cloudflare/vinext/pull/418
Author: @Divkix
Created: 3/10/2026
Status: ✅ Merged
Merged: 3/11/2026
Merged by: @james-elicx

Base: main ← Head: docs/external-rewrite-warning

📝 Commits (9)

2640c27 fix: warn on external rewrites and sanitize Content-Disposition
c9fdd96 fix: improve external rewrite warning and add Content-Disposition sanitization test
96b2916 fix: correct external rewrite warning to reflect actual header forwarding
06a869d fix: address PR review feedback on external rewrite warning
affd28e fix: refine external rewrite warning wording and add source path assertions
c4a128d fix: strip credential headers from outbound proxy requests
8a5f972 fix: align app-router credential stripping test with implementation
afd7048 fix: keep Next.js rewrite forwarding
3aeaf02 fix: restore Next.js external rewrite header forwarding

📊 Changes

6 files changed (+135 additions, -9 deletions)

View changed files

📝 packages/vinext/src/config/next-config.ts (+21 -0)
📝 packages/vinext/src/server/image-optimization.ts (+4 -1)
📝 packages/vinext/src/server/prod-server.ts (+4 -2)
📝 tests/app-router.test.ts (+5 -5)
📝 tests/next-config.test.ts (+82 -0)
📝 tests/shims.test.ts (+19 -1)

📄 Description

Summary

Strip credential headers (cookie, authorization, proxy-authorization, x-api-key) from outbound proxy requests to external origins
Emit startup warning when next.config contains rewrites to external origins, noting that credential headers are stripped
Sanitize contentDispositionType in image optimization and prod server to only allow "attachment" (default "inline")

Closes #414
Closes #430

Test plan

Unit test verifies credential headers are stripped from proxied requests
Unit test verifies warning is emitted for external rewrites
Typecheck, lint, format all pass
Manual: add an external rewrite to a fixture config and verify warning on startup

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/cloudflare/vinext/pull/418 **Author:** [@Divkix](https://github.com/Divkix) **Created:** 3/10/2026 **Status:** ✅ Merged **Merged:** 3/11/2026 **Merged by:** [@james-elicx](https://github.com/james-elicx) **Base:** `main` ← **Head:** `docs/external-rewrite-warning` --- ### 📝 Commits (9) - [`2640c27`](https://github.com/cloudflare/vinext/commit/2640c277fc12072cef6e2fa9de97b09965cec11a) fix: warn on external rewrites and sanitize Content-Disposition - [`c9fdd96`](https://github.com/cloudflare/vinext/commit/c9fdd964a96475ac240b1cf1c450436b705e8ed3) fix: improve external rewrite warning and add Content-Disposition sanitization test - [`96b2916`](https://github.com/cloudflare/vinext/commit/96b2916d6060f65f534cf02f0575046212ebfe4f) fix: correct external rewrite warning to reflect actual header forwarding - [`06a869d`](https://github.com/cloudflare/vinext/commit/06a869d46a53a8228099d71357e6227d62bf3d02) fix: address PR review feedback on external rewrite warning - [`affd28e`](https://github.com/cloudflare/vinext/commit/affd28e79ca31bf35630b861005a8c69e7cabf51) fix: refine external rewrite warning wording and add source path assertions - [`c4a128d`](https://github.com/cloudflare/vinext/commit/c4a128d13e8f4cc11175cce7773d417c530b7001) fix: strip credential headers from outbound proxy requests - [`8a5f972`](https://github.com/cloudflare/vinext/commit/8a5f972bf11c56a7924c20252d7d359e79ca2ad8) fix: align app-router credential stripping test with implementation - [`afd7048`](https://github.com/cloudflare/vinext/commit/afd70488cadd9581b07eb0a51f9371c7bd4f84b2) fix: keep Next.js rewrite forwarding - [`3aeaf02`](https://github.com/cloudflare/vinext/commit/3aeaf022ec497e965c5d224b4a105f9f065d76f2) fix: restore Next.js external rewrite header forwarding ### 📊 Changes **6 files changed** (+135 additions, -9 deletions) <details> <summary>View changed files</summary> 📝 `packages/vinext/src/config/next-config.ts` (+21 -0) 📝 `packages/vinext/src/server/image-optimization.ts` (+4 -1) 📝 `packages/vinext/src/server/prod-server.ts` (+4 -2) 📝 `tests/app-router.test.ts` (+5 -5) 📝 `tests/next-config.test.ts` (+82 -0) 📝 `tests/shims.test.ts` (+19 -1) </details> ### 📄 Description ## Summary - Strip credential headers (`cookie`, `authorization`, `proxy-authorization`, `x-api-key`) from outbound proxy requests to external origins - Emit startup warning when `next.config` contains rewrites to external origins, noting that credential headers are stripped - Sanitize `contentDispositionType` in image optimization and prod server to only allow `"attachment"` (default `"inline"`) Closes #414 Closes #430 ## Test plan - [x] Unit test verifies credential headers are stripped from proxied requests - [x] Unit test verifies warning is emitted for external rewrites - [x] Typecheck, lint, format all pass - [x] Manual: add an external rewrite to a fixture config and verify warning on startup --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>