fix: server functions x-forwarded-host possible multiple values #73701

Netail · 2024-12-09T16:49:00Z

Summary

The x-forwarded-host header can be an array (string | string[] | undefined), which used to be casted to string | undefined. So when comparing the origin vs the x-forwarded-host, it ends up comparing an array to a string. Resulting in the following error;

`x-forwarded-host` header with value `www.ah.nl, www.ah.nl` does not match `origin` header with value `www.ah.nl` from a forwarded Server Actions request. Aborting the action.

ijjk · 2024-12-09T16:49:36Z

Allow CI Workflow Run

approve CI run for commit: d430125

Note: this should only be enabled once the PR is ready to go and can only be enabled by a maintainer

ijjk

Hi, could we add a test case for this?

Netail · 2024-12-09T18:42:00Z

Hi, could we add a test case for this?

We can separate the host parsing to it's own function, then test this separately?

ijjk · 2024-12-09T18:48:11Z

That sounds good to me

Netail · 2024-12-09T19:14:07Z

Could this potentially be backported into v14?

ijjk · 2024-12-09T19:17:23Z

Sure, similar PR can be made agains the 14-2-1 branch

ijjk · 2024-12-09T19:28:21Z

Stats from current PR

Default Build (Increase detected ⚠️)

General Overall increase ⚠️

	vercel/next.js canary	Netail/next.js fix/server-functions-x-forwarded-host	Change
buildDuration	27.8s	26s	N/A
buildDurationCached	24.1s	20.3s	N/A
nodeModulesSize	409 MB	409 MB	⚠️ +15.5 kB
nextStartRea..uration (ms)	835ms	792ms	N/A

Client Bundles (main, webpack)

	vercel/next.js canary	Netail/next.js fix/server-functions-x-forwarded-host	Change
1187-HASH.js gzip	50.2 kB	50.2 kB	N/A
8276.HASH.js gzip	169 B	168 B	N/A
8377-HASH.js gzip	5.3 kB	5.3 kB	N/A
bccd1874-HASH.js gzip	53 kB	53 kB	N/A
framework-HASH.js gzip	57.5 kB	57.5 kB	N/A
main-app-HASH.js gzip	232 B	235 B	N/A
main-HASH.js gzip	33.8 kB	33.7 kB	N/A
webpack-HASH.js gzip	1.71 kB	1.71 kB	N/A
Overall change	0 B	0 B	✓

Legacy Client Bundles (polyfills)

	vercel/next.js canary	Netail/next.js fix/server-functions-x-forwarded-host	Change
polyfills-HASH.js gzip	39.4 kB	39.4 kB	✓
Overall change	39.4 kB	39.4 kB	✓

Client Pages

	vercel/next.js canary	Netail/next.js fix/server-functions-x-forwarded-host	Change
_app-HASH.js gzip	193 B	193 B	✓
_error-HASH.js gzip	193 B	193 B	✓
amp-HASH.js gzip	512 B	510 B	N/A
css-HASH.js gzip	343 B	342 B	N/A
dynamic-HASH.js gzip	1.84 kB	1.84 kB	✓
edge-ssr-HASH.js gzip	265 B	265 B	✓
head-HASH.js gzip	363 B	362 B	N/A
hooks-HASH.js gzip	393 B	392 B	N/A
image-HASH.js gzip	4.44 kB	4.43 kB	N/A
index-HASH.js gzip	268 B	268 B	✓
link-HASH.js gzip	2.35 kB	2.34 kB	N/A
routerDirect..HASH.js gzip	328 B	328 B	✓
script-HASH.js gzip	397 B	397 B	✓
withRouter-HASH.js gzip	323 B	326 B	N/A
1afbb74e6ecf..834.css gzip	106 B	106 B	✓
Overall change	3.59 kB	3.59 kB	✓

Client Build Manifests

	vercel/next.js canary	Netail/next.js fix/server-functions-x-forwarded-host	Change
_buildManifest.js gzip	747 B	745 B	N/A
Overall change	0 B	0 B	✓

Rendered Page Sizes

	vercel/next.js canary	Netail/next.js fix/server-functions-x-forwarded-host	Change
index.html gzip	524 B	523 B	N/A
link.html gzip	538 B	538 B	✓
withRouter.html gzip	520 B	520 B	✓
Overall change	1.06 kB	1.06 kB	✓

Edge SSR bundle Size

	vercel/next.js canary	Netail/next.js fix/server-functions-x-forwarded-host	Change
edge-ssr.js gzip	128 kB	128 kB	N/A
page.js gzip	203 kB	203 kB	N/A
Overall change	0 B	0 B	✓

Middleware size

	vercel/next.js canary	Netail/next.js fix/server-functions-x-forwarded-host	Change
middleware-b..fest.js gzip	671 B	668 B	N/A
middleware-r..fest.js gzip	155 B	156 B	N/A
middleware.js gzip	31 kB	31 kB	N/A
edge-runtime..pack.js gzip	844 B	844 B	✓
Overall change	844 B	844 B	✓

Next Runtimes

	vercel/next.js canary	Netail/next.js fix/server-functions-x-forwarded-host	Change
523-experime...dev.js gzip	322 B	322 B	✓
523.runtime.dev.js gzip	314 B	314 B	✓
app-page-exp...dev.js gzip	322 kB	322 kB	N/A
app-page-exp..prod.js gzip	127 kB	127 kB	N/A
app-page-tur..prod.js gzip	140 kB	140 kB	N/A
app-page-tur..prod.js gzip	135 kB	135 kB	N/A
app-page.run...dev.js gzip	312 kB	312 kB	N/A
app-page.run..prod.js gzip	122 kB	122 kB	N/A
app-route-ex...dev.js gzip	37.1 kB	37.1 kB	✓
app-route-ex..prod.js gzip	25.1 kB	25.1 kB	✓
app-route-tu..prod.js gzip	25.1 kB	25.1 kB	✓
app-route-tu..prod.js gzip	24.9 kB	24.9 kB	✓
app-route.ru...dev.js gzip	38.7 kB	38.7 kB	✓
app-route.ru..prod.js gzip	24.9 kB	24.9 kB	✓
pages-api-tu..prod.js gzip	9.56 kB	9.56 kB	✓
pages-api.ru...dev.js gzip	11.4 kB	11.4 kB	✓
pages-api.ru..prod.js gzip	9.56 kB	9.56 kB	✓
pages-turbo...prod.js gzip	21.3 kB	21.3 kB	✓
pages.runtim...dev.js gzip	27 kB	27 kB	✓
pages.runtim..prod.js gzip	21.3 kB	21.3 kB	✓
server.runti..prod.js gzip	916 kB	916 kB	✓
Overall change	1.19 MB	1.19 MB	✓

build cache Overall increase ⚠️

	vercel/next.js canary	Netail/next.js fix/server-functions-x-forwarded-host	Change
0.pack gzip	2.03 MB	2.04 MB	⚠️ +1.02 kB
index.pack gzip	71.9 kB	72.4 kB	⚠️ +498 B
Overall change	2.11 MB	2.11 MB	⚠️ +1.52 kB

Diff details

Diff for main-HASH.js

Diff too large to display

Diff for app-page-exp..ntime.dev.js

Diff too large to display

Diff for app-page-exp..time.prod.js

Diff too large to display

Diff for app-page-tur..time.prod.js

Diff too large to display

Diff for app-page-tur..time.prod.js

Diff too large to display

Diff for app-page.runtime.dev.js

Diff too large to display

Diff for app-page.runtime.prod.js

Diff too large to display

Commit: 2cf36e2

Netail · 2024-12-09T19:44:26Z

~~Need to check 1 more thing tho, one sec 😅~~

ijjk · 2024-12-09T19:45:26Z

Failing test suites

Commit: 2cf36e2

pnpm test test/integration/clean-distdir/test/index.test.js (turbopack)

Cleaning distDir > production mode > should clean up .next before build start
Cleaning distDir > production mode > disabled write > should not clean up .next before build start

Expand output

● Cleaning distDir › production mode › should clean up .next before build start

thrown: "Exceeded timeout of 60000 ms for a test.
Add a timeout value to this test to increase the timeout, if this is a long-running test. See https://jestjs.io/docs/api#testname-fn-timeout."

  25 |
  26 | const runTests = () => {
> 27 |   it('should clean up .next before build start', async () => {
     |   ^
  28 |     await checkFileWrite(false)
  29 |   })
  30 | }

  at it (integration/clean-distdir/test/index.test.js:27:3)
  at runTests (integration/clean-distdir/test/index.test.js:40:7)
  at integration/clean-distdir/test/index.test.js:33:56
  at Object.describe (integration/clean-distdir/test/index.test.js:32:1)

● Cleaning distDir › production mode › disabled write › should not clean up .next before build start

thrown: "Exceeded timeout of 60000 ms for a test.
Add a timeout value to this test to increase the timeout, if this is a long-running test. See https://jestjs.io/docs/api#testname-fn-timeout."

  56 |         })
  57 |
> 58 |         it('should not clean up .next before build start', async () => {
     |         ^
  59 |           await checkFileWrite(true)
  60 |         })
  61 |       })

  at it (integration/clean-distdir/test/index.test.js:58:9)
  at describe (integration/clean-distdir/test/index.test.js:42:7)
  at integration/clean-distdir/test/index.test.js:33:56
  at Object.describe (integration/clean-distdir/test/index.test.js:32:1)

Read more about building and testing Next.js in contributing.md.

__NEXT_EXPERIMENTAL_PPR=true pnpm test-dev test/e2e/socket-io/index.test.js (PPR)

socket-io > should support socket.io without falling back to polling

Expand output

● socket-io › should support socket.io without falling back to polling

TIMED OUT: /hello world/



undefined

  731 |
  732 |   if (hardError) {
> 733 |     throw new Error('TIMED OUT: ' + regex + '\n\n' + content + '\n\n' + lastErr)
      |           ^
  734 |   }
  735 |   return false
  736 | }

  at check (lib/next-test-utils.ts:733:11)
  at Object.<anonymous> (e2e/socket-io/index.test.js:31:5)

Read more about building and testing Next.js in contributing.md.

pnpm test-dev test/development/acceptance-app/ReactRefreshLogBox.test.ts

ReactRefreshLogBox app default > server component can recover from error thrown in the module

Expand output

● ReactRefreshLogBox app default › server component can recover from error thrown in the module

Expected Redbox but found none

  1060 |
  1061 |       await next.patchFile('index.js', "throw new Error('module error')")
> 1062 |       await session.assertHasRedbox()
       |       ^
  1063 |       await next.patchFile(
  1064 |         'index.js',
  1065 |         'export default function Page() {return <p>hello world</p>}'

  at Object.<anonymous> (development/acceptance-app/ReactRefreshLogBox.test.ts:1062:7)

Read more about building and testing Next.js in contributing.md.

Netail · 2024-12-09T22:03:14Z

Alright, so basically a Apache proxy prepends the host to the current value (comma separated), so will add that use case too

https://sources.debian.org/src/apache2/2.4.62-6/modules/proxy/proxy_util.c/#L4755

Netail · 2024-12-10T08:32:51Z

Should be good to go :)

ijjk added the type: next label Dec 9, 2024

Netail changed the title ~~fix: server functions x-forwarded-host multiple values~~ fix: server functions x-forwarded-host possible multiple values Dec 9, 2024

Netail marked this pull request as draft December 9, 2024 17:02

fix: server functions x-forwarded-host multiple values

3ea80a0

Netail force-pushed the fix/server-functions-x-forwarded-host branch from 3096cb7 to 3ea80a0 Compare December 9, 2024 17:07

Netail marked this pull request as ready for review December 9, 2024 17:17

ijjk reviewed Dec 9, 2024

View reviewed changes

test: split parseHostHeader and add unit tests

e1dffb4

Netail force-pushed the fix/server-functions-x-forwarded-host branch from 5a9f274 to e1dffb4 Compare December 9, 2024 19:03

Merge branch 'canary' into fix/server-functions-x-forwarded-host

f44e670

Merge branch 'canary' into fix/server-functions-x-forwarded-host

ad549dd

Netail added 2 commits December 9, 2024 23:04

fix: support comma separated string

86b2f63

Merge branch 'canary' into fix/server-functions-x-forwarded-host

5050ff0

ijjk and others added 4 commits December 10, 2024 07:57

Merge branch 'canary' into fix/server-functions-x-forwarded-host

2cf36e2

Merge branch 'canary' into fix/server-functions-x-forwarded-host

6552544

Merge branch 'canary' into fix/server-functions-x-forwarded-host

e029f05

Merge branch 'canary' into fix/server-functions-x-forwarded-host

d430125

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: server functions x-forwarded-host possible multiple values #73701

fix: server functions x-forwarded-host possible multiple values #73701

Netail commented Dec 9, 2024 •

edited

Loading

ijjk commented Dec 9, 2024 •

edited

Loading

ijjk left a comment

Netail commented Dec 9, 2024 •

edited

Loading

ijjk commented Dec 9, 2024

Netail commented Dec 9, 2024

ijjk commented Dec 9, 2024

ijjk commented Dec 9, 2024 •

edited

Loading

Netail commented Dec 9, 2024 •

edited

Loading

ijjk commented Dec 9, 2024 •

edited

Loading

Netail commented Dec 9, 2024 •

edited

Loading

Netail commented Dec 10, 2024

fix: server functions x-forwarded-host possible multiple values #73701

Are you sure you want to change the base?

fix: server functions x-forwarded-host possible multiple values #73701

Conversation

Netail commented Dec 9, 2024 • edited Loading

Summary

ijjk commented Dec 9, 2024 • edited Loading

ijjk left a comment

Choose a reason for hiding this comment

Netail commented Dec 9, 2024 • edited Loading

ijjk commented Dec 9, 2024

Netail commented Dec 9, 2024

ijjk commented Dec 9, 2024

ijjk commented Dec 9, 2024 • edited Loading

Stats from current PR

Netail commented Dec 9, 2024 • edited Loading

ijjk commented Dec 9, 2024 • edited Loading

Failing test suites

Netail commented Dec 9, 2024 • edited Loading

Netail commented Dec 10, 2024

Netail commented Dec 9, 2024 •

edited

Loading

ijjk commented Dec 9, 2024 •

edited

Loading

Netail commented Dec 9, 2024 •

edited

Loading

ijjk commented Dec 9, 2024 •

edited

Loading

Netail commented Dec 9, 2024 •

edited

Loading

ijjk commented Dec 9, 2024 •

edited

Loading

Netail commented Dec 9, 2024 •

edited

Loading