[PR #813] [MERGED] fix: apply middleware request-header overrides before App->Pages fallback #864

New issue

Closed

opened 2026-05-06 13:10:31 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-06 13:10:31 +02:00

Owner

📋 Pull Request Information

Original PR: https://github.com/cloudflare/vinext/pull/813
Author: @southpolesteve
Created: 4/10/2026
Status: ✅ Merged
Merged: 4/10/2026
Merged by: @southpolesteve

Base: main ← Head: fix/app-pages-fallback-sees-middleware-overrides

📝 Commits (2)

0fc731b fix: apply middleware request-header overrides before App->Pages fallback
c9bcc83 test: regenerate App Router entry snapshots for middleware fallback fix

📊 Changes

3 files changed (+42 additions, -1 deletions)

View changed files

📝 packages/vinext/src/entries/app-rsc-entry.ts (+18 -1)
📝 tests/__snapshots__/entry-templates.test.ts.snap (+6 -0)
📝 tests/app-router.test.ts (+18 -0)

📄 Description

Summary

In mixed App+Pages projects, the App Router production fallback now rebuilds the request from middleware request-header overrides before delegating to Pages SSR.

Details

Middleware request-header overrides were already applied to:

App page rendering
App Route handlers

But the App Router production fallback still delegated to renderPage() with the original Request object. That meant a Pages route reached via App->Pages fallback could still see the original Authorization / Cookie headers in getServerSideProps, even when middleware had deleted them and injected trusted replacement headers.

This change:

rebuilds the fallback request with buildRequestHeadersFromMiddlewareResponse() using the preserved middleware request-header payload
passes that rebuilt request into renderPage()
keeps passing the preserved middleware header payload into the existing middlewareHeaders parameter as before

Tests

Adds a production-only regression test verifying that /pages-header-override-delete in a mixed App+Pages project sees:

authorization: null
cookie: null
x-from-middleware: hello-from-middleware

before getServerSideProps runs.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/cloudflare/vinext/pull/813 **Author:** [@southpolesteve](https://github.com/southpolesteve) **Created:** 4/10/2026 **Status:** ✅ Merged **Merged:** 4/10/2026 **Merged by:** [@southpolesteve](https://github.com/southpolesteve) **Base:** `main` ← **Head:** `fix/app-pages-fallback-sees-middleware-overrides` --- ### 📝 Commits (2) - [`0fc731b`](https://github.com/cloudflare/vinext/commit/0fc731bdd9db11748fd2988fc114ce3aca6ace23) fix: apply middleware request-header overrides before App->Pages fallback - [`c9bcc83`](https://github.com/cloudflare/vinext/commit/c9bcc83c95e610347ae6a6814359d40a1368e2e2) test: regenerate App Router entry snapshots for middleware fallback fix ### 📊 Changes **3 files changed** (+42 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `packages/vinext/src/entries/app-rsc-entry.ts` (+18 -1) 📝 `tests/__snapshots__/entry-templates.test.ts.snap` (+6 -0) 📝 `tests/app-router.test.ts` (+18 -0) </details> ### 📄 Description ## Summary In mixed App+Pages projects, the App Router production fallback now rebuilds the request from middleware request-header overrides before delegating to Pages SSR. ## Details Middleware request-header overrides were already applied to: - App page rendering - App Route handlers But the App Router production fallback still delegated to `renderPage()` with the original `Request` object. That meant a Pages route reached via App->Pages fallback could still see the original `Authorization` / `Cookie` headers in `getServerSideProps`, even when middleware had deleted them and injected trusted replacement headers. This change: - rebuilds the fallback request with `buildRequestHeadersFromMiddlewareResponse()` using the preserved middleware request-header payload - passes that rebuilt request into `renderPage()` - keeps passing the preserved middleware header payload into the existing `middlewareHeaders` parameter as before ## Tests Adds a production-only regression test verifying that `/pages-header-override-delete` in a mixed App+Pages project sees: - `authorization: null` - `cookie: null` - `x-from-middleware: hello-from-middleware` before `getServerSideProps` runs. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>