Skip to content

[Experimental Advanced Routing]: Unexpected behavior with X-Forwarded-* headers #16797

Description

@Eptagone

Astro Info

Astro                    v6.3.5
Node                     v22.22.0
System                   Linux (x64)
Package Manager          unknown
Output                   server
Adapter                  @astrojs/node
Integrations             none

If this issue only occurs in one browser, which browser is a problem?

No response

Describe the Bug

When using advanced routing to override X-Forwarded-* headers, the Astro.url doesn't change at all:

If X-Forwarded-Host and X-Forwarded-Proto are sent to the request, the first one is ignored and the second one is applied to the request.url before the fetch function is called in app.ts.

HTTP GET > localhost:4321 headers { X-Forwarded-Host: example.com, X-Forwarded-Proto: https }
import type { Fetchable } from 'astro';
import { FetchState, astro } from 'astro/fetch';

export default {
  async fetch(request: Request): Promise<Response> {
    console.log('Request URL:', request.url); // https://localhost:4321
    const state = new FetchState(request);
    return await astro(state);
  },
} satisfies Fetchable;

If X-Forwarded-Host and/or X-Forwarded-Proto are added/set in the fetch function in app.ts before calling astro handler, both are ignored and Astro.url still has the request url.

HTTP GET > localhost:4321
import type { Fetchable } from 'astro';
import { FetchState, astro } from 'astro/fetch';

export default {
  async fetch(request: Request): Promise<Response> {
    console.log('Request URL:', request.url); // http://localhost:4321
    request.headers.set('X-Forwarded-Host', 'example.com');
    request.headers.set('X-Forwarded-Proto', 'https');

    const state = new FetchState(request);
    return await astro(state); // Expected to have `https://example.com` in Astro.url but it has `http://localhost:4321`
  },
} satisfies Fetchable;

What's the expected result?

Apply both X-Forwarded-Host and X-Forwarded-Proto in astro handler after request modifications.

Link to Minimal Reproducible Example

https://stackblitz.com/edit/github-s1eavjp1?file=src%2Fapp.ts

Participation

  • I am willing to submit a pull request for this issue.

Metadata

Metadata

Assignees

Labels

- P3: minor bugAn edge case that only affects very specific usage (priority)

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions