Harden Partytown reverse proxy recipe#3809
Open
fredericoo wants to merge 1 commit into
Open
Conversation
The Partytown recipe is production guidance, so its same-origin proxy needs to fail closed instead of forwarding unsafe upstream content. This rejects non-JavaScript responses, validates redirects before following them, and adds defensive response headers while regenerating the recipe README and LLM prompt.
Contributor
|
Oxygen deployed a preview of your
Learn more about Hydrogen's GitHub integration. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
WHY are these changes introduced?
Fixes #3808
The Partytown recipe is production guidance, and its reverse proxy should not serve arbitrary upstream content as same-origin storefront content. The previous route allowlisted request origins, but it still forwarded upstream response types directly and let
fetch()follow redirects before the recipe could validate the final target.WHAT is this pull request doing?
Locationis checked against the allowlist before the next request is made.X-Content-Type-Options: nosniffand a restrictive CSP to successful proxied responses.HOW to test your changes?
pnpm --dir cookbook exec vitest run recipes/partytown/__tests__/partytown.test.tspnpm exec prettier --check cookbook/recipes/partytown/__tests__/partytown.test.ts cookbook/recipes/partytown/ingredients/templates/skeleton/app/routes/reverse-proxy.tspatch --dry-run -p1 < cookbook/recipes/partytown/patches/package.json.8e0ff5.patch && patch --dry-run -p1 < cookbook/recipes/partytown/patches/README.md.1764cd.patchgit diff --checkValidation caveat:
pnpm --dir cookbook exec ts-node src/index.ts validate --recipe partytownapplies the recipe cleanly, then fails during skeletoncodegenwith[Codegen] Could not find a schema for "storefront". Retrying with the shared snapshot package version also applies the recipe cleanly, then fails duringcodegenon the React Routerfuture.unstable_splitRouteModulesflag rename.Checklist