[PR #817] [CLOSED] fix: apply middleware request-header overrides before App->Pages fallback #868

New issue

Closed

opened 2026-05-06 13:10:33 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-06 13:10:33 +02:00

Owner

📋 Pull Request Information

Original PR: https://github.com/cloudflare/vinext/pull/817
Author: @southpolesteve
Created: 4/10/2026
Status: ❌ Closed

Base: main ← Head: fix/app-pages-fallback-sees-middleware-overrides-v2

📝 Commits (2)

4f016bf fix: apply middleware request-header overrides before App->Pages fallback
3182d82 fix: rebuild App->Pages fallback request with middleware overrides and regen snapshots

📊 Changes

3 files changed (+43 additions, -1 deletions)

View changed files

📝 packages/vinext/src/entries/app-rsc-entry.ts (+18 -1)
📝 tests/__snapshots__/entry-templates.test.ts.snap (+6 -0)
📝 tests/app-router.test.ts (+19 -0)

📄 Description

Summary

In mixed App+Pages projects, the App Router production fallback now rebuilds the request from middleware request-header overrides before delegating to Pages SSR.

Details

Middleware request-header overrides were already applied to:

App page rendering
App Route handlers

But the App Router production fallback still delegated to renderPage() with the original Request object. That meant a Pages route reached via App->Pages fallback could still see the original Authorization / Cookie headers in getServerSideProps, even when middleware had deleted them and injected trusted replacement headers.

This change:

rebuilds the fallback request with buildRequestHeadersFromMiddlewareResponse() using the preserved middleware request-header payload
passes that rebuilt request into renderPage()
keeps passing the preserved middleware header payload into the existing middlewareHeaders parameter

Tests

Adds a production-only regression test verifying that /pages-header-override-delete in a mixed App+Pages project sees:

authorization: null
cookie: null
x-from-middleware: hello-from-middleware

before getServerSideProps runs.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/cloudflare/vinext/pull/817 **Author:** [@southpolesteve](https://github.com/southpolesteve) **Created:** 4/10/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/app-pages-fallback-sees-middleware-overrides-v2` --- ### 📝 Commits (2) - [`4f016bf`](https://github.com/cloudflare/vinext/commit/4f016bf89c9a729b99e7eab3b0c0538497000123) fix: apply middleware request-header overrides before App->Pages fallback - [`3182d82`](https://github.com/cloudflare/vinext/commit/3182d82576f17f7acff5d193ddcc39a746805663) fix: rebuild App->Pages fallback request with middleware overrides and regen snapshots ### 📊 Changes **3 files changed** (+43 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `packages/vinext/src/entries/app-rsc-entry.ts` (+18 -1) 📝 `tests/__snapshots__/entry-templates.test.ts.snap` (+6 -0) 📝 `tests/app-router.test.ts` (+19 -0) </details> ### 📄 Description ## Summary In mixed App+Pages projects, the App Router production fallback now rebuilds the request from middleware request-header overrides before delegating to Pages SSR. ## Details Middleware request-header overrides were already applied to: - App page rendering - App Route handlers But the App Router production fallback still delegated to `renderPage()` with the original `Request` object. That meant a Pages route reached via App->Pages fallback could still see the original `Authorization` / `Cookie` headers in `getServerSideProps`, even when middleware had deleted them and injected trusted replacement headers. This change: - rebuilds the fallback request with `buildRequestHeadersFromMiddlewareResponse()` using the preserved middleware request-header payload - passes that rebuilt request into `renderPage()` - keeps passing the preserved middleware header payload into the existing `middlewareHeaders` parameter ## Tests Adds a production-only regression test verifying that `/pages-header-override-delete` in a mixed App+Pages project sees: - `authorization: null` - `cookie: null` - `x-from-middleware: hello-from-middleware` before `getServerSideProps` runs. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>