[GH-ISSUE #414] docs/runtime: warn when external rewrites proxy requests to third-party origins #89

New issue

Closed

opened 2026-05-06 12:37:08 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-06 12:37:08 +02:00

Owner

Originally created by @Divkix on GitHub (Mar 10, 2026).
Original GitHub issue: https://github.com/cloudflare/vinext/issues/414

Problem

External rewrites in next.config act as reverse proxies — vinext fetches the external URL server-side and returns the response to the client. Currently, credential headers (cookie, authorization, x-api-key, proxy-authorization) are forwarded to the external origin without any warning.

This is a security concern: developers may not realize that adding an external rewrite silently proxies credentials to a third-party server.

Proposed Solution

Startup warning: After resolving next.config rewrites, scan destinations for external URLs. If any are found, emit a console.warn listing the external rewrites and noting that credential headers are forwarded.
Documentation: Add a note in relevant docs about the security implications of external rewrites.

Additionally, fold in Content-Disposition type validation to sanitize the contentDispositionType config value at runtime (default to "inline" unless explicitly set to "attachment").

Acceptance Criteria

console.warn emitted at startup when external rewrites are configured
Warning lists source → destination for each external rewrite
Warning notes which credential headers are forwarded
Content-Disposition type validated in image optimization and prod server
Tests cover the warning behavior

Originally created by @Divkix on GitHub (Mar 10, 2026). Original GitHub issue: https://github.com/cloudflare/vinext/issues/414 ## Problem External rewrites in `next.config` act as reverse proxies — vinext fetches the external URL server-side and returns the response to the client. Currently, credential headers (`cookie`, `authorization`, `x-api-key`, `proxy-authorization`) are forwarded to the external origin without any warning. This is a security concern: developers may not realize that adding an external rewrite silently proxies credentials to a third-party server. ## Proposed Solution 1. **Startup warning**: After resolving `next.config` rewrites, scan destinations for external URLs. If any are found, emit a `console.warn` listing the external rewrites and noting that credential headers are forwarded. 2. **Documentation**: Add a note in relevant docs about the security implications of external rewrites. Additionally, fold in Content-Disposition type validation to sanitize the `contentDispositionType` config value at runtime (default to `"inline"` unless explicitly set to `"attachment"`). ## Acceptance Criteria - [x] `console.warn` emitted at startup when external rewrites are configured - [x] Warning lists source → destination for each external rewrite - [x] Warning notes which credential headers are forwarded - [x] Content-Disposition type validated in image optimization and prod server - [x] Tests cover the warning behavior