[PR #762] [MERGED] fix: apply middleware headers to intercept route and server action responses #825

New issue

Closed

opened 2026-05-06 13:10:19 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-06 13:10:19 +02:00

Owner

📋 Pull Request Information

Original PR: https://github.com/cloudflare/vinext/pull/762
Author: @NathanDrake2406
Created: 4/3/2026
Status: ✅ Merged
Merged: 4/3/2026
Merged by: @james-elicx

Base: main ← Head: fix/middleware-headers-intercept-action

📝 Commits (3)

9027123 fix: apply middleware headers to intercept route and server action responses
d0bf61a fix: merge middleware headers before x-action-redirect control headers
c89252a fix: update RSC entry snapshots for middleware headers

📊 Changes

6 files changed (+260 additions, -77 deletions)

View changed files

📝 packages/vinext/src/entries/app-rsc-entry.ts (+20 -9)
📝 packages/vinext/src/server/app-page-response.ts (+29 -14)
📝 tests/__snapshots__/entry-templates.test.ts.snap (+114 -54)
📝 tests/app-page-response.test.ts (+45 -0)
📝 tests/app-router.test.ts (+50 -0)
📝 tests/fixtures/app-basic/middleware.ts (+2 -0)

📄 Description

Summary

Middleware response headers (_mwCtx.headers) were silently dropped on three code paths: intercepting route responses, server action re-render responses, and server action redirect responses
All three constructed Response objects directly without merging middleware headers, unlike the normal page path which goes through buildAppPageRscResponse()
This caused auth cookies, CORS headers, and security headers set in middleware to be missing from these response types
Extracted mergeMiddlewareResponseHeaders() from buildAppPageRscResponse() and applied it to all three paths, plus refactored the original caller to use the shared helper

Test plan

Added unit tests for mergeMiddlewareResponseHeaders helper (null-safe, Set-Cookie/Vary append, other headers set)
Added integration test verifying middleware headers appear on intercept route RSC responses
Added generated-code assertions verifying mergeMiddlewareResponseHeaders is called in intercept, action re-render, and action redirect paths
Existing app-router tests pass (279/279)
Existing features tests pass (264/264)
Entry template snapshots updated

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/cloudflare/vinext/pull/762 **Author:** [@NathanDrake2406](https://github.com/NathanDrake2406) **Created:** 4/3/2026 **Status:** ✅ Merged **Merged:** 4/3/2026 **Merged by:** [@james-elicx](https://github.com/james-elicx) **Base:** `main` ← **Head:** `fix/middleware-headers-intercept-action` --- ### 📝 Commits (3) - [`9027123`](https://github.com/cloudflare/vinext/commit/90271239d05bf349bd0b239e88cab87093b05233) fix: apply middleware headers to intercept route and server action responses - [`d0bf61a`](https://github.com/cloudflare/vinext/commit/d0bf61a0d85b5c2dd6f59170e1578aa74ff091ab) fix: merge middleware headers before x-action-redirect control headers - [`c89252a`](https://github.com/cloudflare/vinext/commit/c89252ab79303f360d41f6735561e7c26aeb6c8d) fix: update RSC entry snapshots for middleware headers ### 📊 Changes **6 files changed** (+260 additions, -77 deletions) <details> <summary>View changed files</summary> 📝 `packages/vinext/src/entries/app-rsc-entry.ts` (+20 -9) 📝 `packages/vinext/src/server/app-page-response.ts` (+29 -14) 📝 `tests/__snapshots__/entry-templates.test.ts.snap` (+114 -54) 📝 `tests/app-page-response.test.ts` (+45 -0) 📝 `tests/app-router.test.ts` (+50 -0) 📝 `tests/fixtures/app-basic/middleware.ts` (+2 -0) </details> ### 📄 Description ## Summary - Middleware response headers (`_mwCtx.headers`) were silently dropped on three code paths: intercepting route responses, server action re-render responses, and server action redirect responses - All three constructed `Response` objects directly without merging middleware headers, unlike the normal page path which goes through `buildAppPageRscResponse()` - This caused auth cookies, CORS headers, and security headers set in middleware to be missing from these response types - Extracted `mergeMiddlewareResponseHeaders()` from `buildAppPageRscResponse()` and applied it to all three paths, plus refactored the original caller to use the shared helper ## Test plan - [x] Added unit tests for `mergeMiddlewareResponseHeaders` helper (null-safe, Set-Cookie/Vary append, other headers set) - [x] Added integration test verifying middleware headers appear on intercept route RSC responses - [x] Added generated-code assertions verifying `mergeMiddlewareResponseHeaders` is called in intercept, action re-render, and action redirect paths - [x] Existing app-router tests pass (279/279) - [x] Existing features tests pass (264/264) - [x] Entry template snapshots updated --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>