[PR #571] [MERGED] fix: harden origin validation and proxy request handling #679

New issue

Closed

opened 2026-05-06 13:09:30 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-06 13:09:30 +02:00

Owner

📋 Pull Request Information

Original PR: https://github.com/cloudflare/vinext/pull/571
Author: @mhart
Created: 3/17/2026
Status: ✅ Merged
Merged: 3/17/2026
Merged by: @southpolesteve

Base: main ← Head: origin-checks

📝 Commits (4)

ec0c8cd Treat Origin: "null" as an explicit cross-origin value
dfa9382 Further hardening
0500d8d Add Vite HMR websocket token regression tests
69d635f Add clarifying comment and share a single dev server

📊 Changes

9 files changed (+314 additions, -30 deletions)

View changed files

📝 packages/vinext/src/config/config-matchers.ts (+37 -2)
📝 packages/vinext/src/server/dev-origin-check.ts (+18 -3)
📝 packages/vinext/src/server/request-pipeline.ts (+18 -5)
📝 tests/__snapshots__/entry-templates.test.ts.snap (+60 -6)
📝 tests/app-router.test.ts (+7 -6)
📝 tests/dev-origin-check.test.ts (+6 -2)
📝 tests/request-pipeline.test.ts (+20 -6)
📝 tests/shims.test.ts (+44 -0)
➕ tests/vite-hmr-websocket.test.ts (+104 -0)

📄 Description

Treat Origin: "null" as an explicit cross-origin value in both dev request validation and Server Action CSRF checks, so sandboxed or opaque browser contexts are blocked unless they are explicitly allowlisted.
Harden external rewrite proxying by stripping hop-by-hop transport headers before forwarding requests, add regression coverage for those headers, and tighten CSRF host fallback to use request.url when Host is missing.
Add Vite HMR websocket regression tests that verify upgrades with an Origin header require a valid HMR token, then clean up that coverage by sharing a single dev server and documenting why proxy auth headers are intentionally preserved for request proxying.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/cloudflare/vinext/pull/571 **Author:** [@mhart](https://github.com/mhart) **Created:** 3/17/2026 **Status:** ✅ Merged **Merged:** 3/17/2026 **Merged by:** [@southpolesteve](https://github.com/southpolesteve) **Base:** `main` ← **Head:** `origin-checks` --- ### 📝 Commits (4) - [`ec0c8cd`](https://github.com/cloudflare/vinext/commit/ec0c8cdd2670773398074b94fbe9da6d95c08269) Treat `Origin: "null"` as an explicit cross-origin value - [`dfa9382`](https://github.com/cloudflare/vinext/commit/dfa9382107fd4845f9a807c3539866ddf0f8d75b) Further hardening - [`0500d8d`](https://github.com/cloudflare/vinext/commit/0500d8d0165bdb8ab12c0a9729c3010570d20351) Add Vite HMR websocket token regression tests - [`69d635f`](https://github.com/cloudflare/vinext/commit/69d635fbafdb9e8e73661b6ac636633de2f22408) Add clarifying comment and share a single dev server ### 📊 Changes **9 files changed** (+314 additions, -30 deletions) <details> <summary>View changed files</summary> 📝 `packages/vinext/src/config/config-matchers.ts` (+37 -2) 📝 `packages/vinext/src/server/dev-origin-check.ts` (+18 -3) 📝 `packages/vinext/src/server/request-pipeline.ts` (+18 -5) 📝 `tests/__snapshots__/entry-templates.test.ts.snap` (+60 -6) 📝 `tests/app-router.test.ts` (+7 -6) 📝 `tests/dev-origin-check.test.ts` (+6 -2) 📝 `tests/request-pipeline.test.ts` (+20 -6) 📝 `tests/shims.test.ts` (+44 -0) ➕ `tests/vite-hmr-websocket.test.ts` (+104 -0) </details> ### 📄 Description - Treat Origin: "null" as an explicit cross-origin value in both dev request validation and Server Action CSRF checks, so sandboxed or opaque browser contexts are blocked unless they are explicitly allowlisted. - Harden external rewrite proxying by stripping hop-by-hop transport headers before forwarding requests, add regression coverage for those headers, and tighten CSRF host fallback to use request.url when Host is missing. - Add Vite HMR websocket regression tests that verify upgrades with an Origin header require a valid HMR token, then clean up that coverage by sharing a single dev server and documenting why proxy auth headers are intentionally preserved for request proxying. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>