[PR #808] [MERGED] fix: strip internal prerender auth header from external rewrites #859

New issue

Closed

opened 2026-05-06 13:10:30 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-06 13:10:30 +02:00

Owner

📋 Pull Request Information

Original PR: https://github.com/cloudflare/vinext/pull/808
Author: @southpolesteve
Created: 4/9/2026
Status: ✅ Merged
Merged: 4/9/2026
Merged by: @southpolesteve

Base: main ← Head: fix/strip-prerender-secret-from-external-rewrites

📝 Commits (1)

eadec1d fix: strip internal prerender auth header from external rewrites

📊 Changes

3 files changed (+8 additions, -0 deletions)

View changed files

📝 packages/vinext/src/config/config-matchers.ts (+4 -0)
📝 tests/app-router.test.ts (+2 -0)
📝 tests/shims.test.ts (+2 -0)

📄 Description

Summary

The shared external rewrite proxy now strips x-vinext-prerender-secret before forwarding requests upstream.

Details

proxyExternalRequest() intentionally forwards most request headers to match external rewrite proxying behavior, while stripping hop-by-hop and x-middleware-* headers. During vinext's prerender pipeline, internal HTTP requests carry x-vinext-prerender-secret so hidden prerender endpoints can authenticate.

That internal auth header should never be forwarded to external rewrite destinations.

This change adds a targeted strip in proxyExternalRequest() and extends the existing external rewrite forwarding tests to verify:

credential headers still forward
x-middleware-* headers are still stripped
x-vinext-prerender-secret is also stripped

Tests

tests/shims.test.ts external rewrite proxy unit test
tests/app-router.test.ts external rewrite integration test

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/cloudflare/vinext/pull/808 **Author:** [@southpolesteve](https://github.com/southpolesteve) **Created:** 4/9/2026 **Status:** ✅ Merged **Merged:** 4/9/2026 **Merged by:** [@southpolesteve](https://github.com/southpolesteve) **Base:** `main` ← **Head:** `fix/strip-prerender-secret-from-external-rewrites` --- ### 📝 Commits (1) - [`eadec1d`](https://github.com/cloudflare/vinext/commit/eadec1ddc67b38122c5c9daedbf439903d5a5c96) fix: strip internal prerender auth header from external rewrites ### 📊 Changes **3 files changed** (+8 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `packages/vinext/src/config/config-matchers.ts` (+4 -0) 📝 `tests/app-router.test.ts` (+2 -0) 📝 `tests/shims.test.ts` (+2 -0) </details> ### 📄 Description ## Summary The shared external rewrite proxy now strips `x-vinext-prerender-secret` before forwarding requests upstream. ## Details `proxyExternalRequest()` intentionally forwards most request headers to match external rewrite proxying behavior, while stripping hop-by-hop and `x-middleware-*` headers. During vinext's prerender pipeline, internal HTTP requests carry `x-vinext-prerender-secret` so hidden prerender endpoints can authenticate. That internal auth header should never be forwarded to external rewrite destinations. This change adds a targeted strip in `proxyExternalRequest()` and extends the existing external rewrite forwarding tests to verify: - credential headers still forward - `x-middleware-*` headers are still stripped - `x-vinext-prerender-secret` is also stripped ## Tests - `tests/shims.test.ts` external rewrite proxy unit test - `tests/app-router.test.ts` external rewrite integration test --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>