From e9321d596b7ba1c1ec99240f8f19443c37423dad Mon Sep 17 00:00:00 2001 From: Nathan Flurry Date: Wed, 26 Aug 2026 19:09:48 -0700 Subject: [PATCH] fix(rivetkit): add serverless request validation --- .../rivetkit-core/src/registry/envoy_callbacks.rs | 4 +++- .../packages/rivetkit-napi/src/registry.rs | 8 ++++++-- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/rivetkit-rust/packages/rivetkit-core/src/registry/envoy_callbacks.rs b/rivetkit-rust/packages/rivetkit-core/src/registry/envoy_callbacks.rs index fdc241d292..43547122b7 100644 --- a/rivetkit-rust/packages/rivetkit-core/src/registry/envoy_callbacks.rs +++ b/rivetkit-rust/packages/rivetkit-core/src/registry/envoy_callbacks.rs @@ -216,7 +216,9 @@ impl ServeConfig { serverless_client_token: settings.serverless_client_token, serverless_validate_endpoint: settings.serverless_validate_endpoint, serverless_max_start_payload_bytes: settings.serverless_max_start_payload_bytes, - serverless_cache_envoy: true, + // TODO: Flip this back to true. Currently disabled because we need a unique + // connection to verify the serverless token. + serverless_cache_envoy: false, ..Default::default() } } diff --git a/rivetkit-typescript/packages/rivetkit-napi/src/registry.rs b/rivetkit-typescript/packages/rivetkit-napi/src/registry.rs index 6820684eb0..0073f1e64d 100644 --- a/rivetkit-typescript/packages/rivetkit-napi/src/registry.rs +++ b/rivetkit-typescript/packages/rivetkit-napi/src/registry.rs @@ -200,7 +200,9 @@ impl CoreRegistry { } }; - let serve_config = serve_config_from_js(config, false, true); + // TODO: Flip this back to true. Currently disabled because we need a unique + // connection to verify the serverless token. + let serve_config = serve_config_from_js(config, false, false); *self.route_package_version.lock() = Some(serve_config.serverless_package_version.clone()); *self.route_metadata.lock() = Some(metadata_response( registry.normal_metadata_payload(&serve_config), @@ -635,7 +637,9 @@ impl CoreRegistry { registry: NativeCoreRegistry, config: JsServeConfig, ) -> napi::Result { - let serve_config = serve_config_from_js(config, true, true); + // TODO: Flip this back to true. Currently disabled because we need a unique + // connection to verify the serverless token. + let serve_config = serve_config_from_js(config, true, false); *self.route_package_version.lock() = Some(serve_config.serverless_package_version.clone()); *self.route_metadata.lock() = Some(metadata_response( registry.serverless_metadata_payload(&serve_config),