Change Action cookie redirects to an opt-in feature users can implement using middleware. This means Actions submitted from an HTML form action will no longer redirect to the destination as a GET request. Instead, the page will be rendered as a POST result.

This is meant to address the 4 KB size limit users have encountered when calling actions from an HTML form action. It can be difficult to predict the size of an action result for large validation errors or longer return values, like AI chatbot results.

So, we've introduced a new getActionContext() utility to let you decide how action results are handled from middleware. You may choose to implement the existing cookie redirect from Astro v4, or implement forwarding with your own session storage.

Here is an example of how our built-in POST middleware works. This calls the appropriate action handler and sets the result to be accessible from Astro.getActionResult():

export const onRequest = defineMiddleware(async (context, next) => {
	if (context.isPrerendered) return next();
	const { action, setActionResult, serializeActionResult } = getActionContext(context);

	if (action?.calledFrom === 'form') {
		const actionResult = await action.handler();
		setActionResult(action.name, serializeActionResult(actionResult));
	}
	return next();
});

See the changeset for a sample implementation of cookie forwarding from Astro v4.

Changes

• Introduce a getActionContext() utility that exposes utilities to get an action request and set the result
• Update runtime/middleware and runtime/route to dogfood this function
• Remove all cookie forwarding behavior from the previous middleware
• Expose new context.originPathname property. This is used to retrieve the original pathname through any rewrites. Needed for users to DIY cookie forwarding, and should be useful for middleware authors in general.

Testing

• Add integration and e2e tests for DIY cookie redirect implementation
• Add test for RPC security gate

Docs

withastro/docs#9943