[PR #809] [MERGED] fix: apply middleware request-header overrides to App Route request objects #861

New issue

Closed

opened 2026-05-06 13:10:31 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-06 13:10:31 +02:00

Owner

📋 Pull Request Information

Original PR: https://github.com/cloudflare/vinext/pull/809
Author: @southpolesteve
Created: 4/9/2026
Status: ✅ Merged
Merged: 4/10/2026
Merged by: @james-elicx

Base: main ← Head: fix/app-route-request-sees-middleware-overrides

📝 Commits (3)

cfcfeb8 fix: apply middleware request-header overrides to App Route request objects
4bdca8c chore: trigger fresh CI run for PR #809
60c4910 regen snaps

📊 Changes

7 files changed (+94 additions, -11 deletions)

View changed files

📝 packages/vinext/src/entries/app-rsc-entry.ts (+5 -1)
📝 packages/vinext/src/server/app-route-handler-execution.ts (+2 -0)
📝 packages/vinext/src/server/app-route-handler-runtime.ts (+36 -3)
📝 tests/__snapshots__/entry-templates.test.ts.snap (+15 -6)
📝 tests/app-router.test.ts (+19 -0)
➕ tests/fixtures/app-basic/app/api/header-override-delete/route.ts (+15 -0)
📝 tests/fixtures/app-basic/middleware.ts (+2 -1)

📄 Description

Summary

App Route handlers now receive a request object rebuilt from middleware request-header overrides, so request.headers and headers() agree after middleware mutations.

Details

Middleware request-header overrides were already applied to the next/headers ALS context, so headers() reflected the middleware-modified request state. But App Route handlers still received a tracked NextRequest built from the original request object, so request.headers exposed the pre-middleware Authorization/Cookie headers.

This change:

preserves a clone of the middleware response headers before internal x-middleware-* headers are stripped for response safety
threads that preserved header set into the typed App Route execution module
rebuilds the underlying Request with buildRequestHeadersFromMiddlewareResponse() before constructing the tracked NextRequest

Tests

Adds an App Route fixture and integration test proving that after middleware deletes credential headers and injects x-from-middleware, both:

request.headers
headers()

see the same middleware-modified values.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/cloudflare/vinext/pull/809 **Author:** [@southpolesteve](https://github.com/southpolesteve) **Created:** 4/9/2026 **Status:** ✅ Merged **Merged:** 4/10/2026 **Merged by:** [@james-elicx](https://github.com/james-elicx) **Base:** `main` ← **Head:** `fix/app-route-request-sees-middleware-overrides` --- ### 📝 Commits (3) - [`cfcfeb8`](https://github.com/cloudflare/vinext/commit/cfcfeb850ffe47a668fa08e24bde596c6871229c) fix: apply middleware request-header overrides to App Route request objects - [`4bdca8c`](https://github.com/cloudflare/vinext/commit/4bdca8cf4344a398fb9362f92a1312423380ccc4) chore: trigger fresh CI run for PR #809 - [`60c4910`](https://github.com/cloudflare/vinext/commit/60c49100c42901216c00db582a6e7f72ddf8b1e7) regen snaps ### 📊 Changes **7 files changed** (+94 additions, -11 deletions) <details> <summary>View changed files</summary> 📝 `packages/vinext/src/entries/app-rsc-entry.ts` (+5 -1) 📝 `packages/vinext/src/server/app-route-handler-execution.ts` (+2 -0) 📝 `packages/vinext/src/server/app-route-handler-runtime.ts` (+36 -3) 📝 `tests/__snapshots__/entry-templates.test.ts.snap` (+15 -6) 📝 `tests/app-router.test.ts` (+19 -0) ➕ `tests/fixtures/app-basic/app/api/header-override-delete/route.ts` (+15 -0) 📝 `tests/fixtures/app-basic/middleware.ts` (+2 -1) </details> ### 📄 Description ## Summary App Route handlers now receive a request object rebuilt from middleware request-header overrides, so `request.headers` and `headers()` agree after middleware mutations. ## Details Middleware request-header overrides were already applied to the `next/headers` ALS context, so `headers()` reflected the middleware-modified request state. But App Route handlers still received a tracked `NextRequest` built from the original request object, so `request.headers` exposed the pre-middleware Authorization/Cookie headers. This change: - preserves a clone of the middleware response headers before internal `x-middleware-*` headers are stripped for response safety - threads that preserved header set into the typed App Route execution module - rebuilds the underlying `Request` with `buildRequestHeadersFromMiddlewareResponse()` before constructing the tracked `NextRequest` ## Tests Adds an App Route fixture and integration test proving that after middleware deletes credential headers and injects `x-from-middleware`, both: - `request.headers` - `headers()` see the same middleware-modified values. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>