fix(adapter-cloudflare): preserve user _headers rules that collide with autogenerated immutable headers - #16171
Closed
mcmxcdev wants to merge 3 commits into
Closed
Conversation
…with autogenerated immutable headers Cloudflare only applies the last matching rule for a given path and combines colliding header values, so naively appending the autogenerated immutable headers section silently dropped (or comma-joined) user-defined rules for `/<app_dir>/*` and `/<app_dir>/immutable/*`. Now we parse the user's `_headers`, strip any colliding blocks, and merge their headers into a single autogenerated block per path. Adapter headers are negated first (`! <name>`) so they reliably override colliding user values instead of being combined. Fixes sveltejs#15862 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
🦋 Changeset detectedLatest commit: 1f249b3 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
`parse_headers` does not end a block on a blank line, but `strip_headers_rules` reset `skip` on blank lines. A header line after a blank inside a colliding block survived as an orphaned line and was also duplicated in the merged autogenerated section. Stop resetting `skip` so both functions treat blank lines consistently. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
6 tasks
teemingc
added a commit
that referenced
this pull request
Jun 27, 2026
closes #15862 A lighter alternative to #16171 , where we just add the rules under the URL if the URL already exists. According to the Cloudflare docs, multiple headers will just be joined with a comma https://developers.cloudflare.com/workers/static-assets/headers/#attach-a-header and we _shouldn't_ worry about someone also declaring new cache header values for those URLs since they're framework related. The original issue is mostly concerned about adding __new__ headers for CORS --- ### Please don't delete this checklist! Before submitting the PR, please make sure you do the following: - [ ] It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs - [x] This message body should clearly illustrate what problems it solves. - [x] Ideally, include a test that fails without this PR but passes with it. ### Tests - [ ] Run the tests with `pnpm test` and lint the project with `pnpm lint` and `pnpm check` ### Changesets - [x] If your PR makes a change that should be noted in one or more packages' changelogs, generate a changeset by running `pnpm changeset` and following the prompts. Changesets that add features should be `minor` and those that fix bugs should be `patch`. Please prefix changeset messages with `feat:`, `fix:`, or `chore:`. ### Edits - [x] Please ensure that 'Allow edits from maintainers' is checked. PRs without this option may be closed.
Member
|
Closed in favour of #16183 |
LNSR
added a commit
to LNSR/wplokerbjm
that referenced
this pull request
Jul 24, 2026
LNSR
added a commit
to LNSR/wplokerbjm
that referenced
this pull request
Jul 24, 2026
LNSR
added a commit
to LNSR/wplokerbjm
that referenced
this pull request
Jul 24, 2026
LNSR
added a commit
to LNSR/wplokerbjm
that referenced
this pull request
Jul 24, 2026
LNSR
added a commit
to LNSR/wplokerbjm
that referenced
this pull request
Jul 24, 2026
LNSR
added a commit
to LNSR/wplokerbjm
that referenced
this pull request
Jul 24, 2026
LNSR
added a commit
to LNSR/wplokerbjm
that referenced
this pull request
Jul 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
@sveltejs/adapter-cloudflareappends an autogenerated immutable-headers section to the user's_headersfile. If the user already defined rules for/<app_dir>/*or/<app_dir>/immutable/*, the result contained two blocks for the same path. Cloudflare only applies the last matching rule per path (and combines colliding header values), so the user's headers were silently dropped — e.g. a customCross-Origin-Embedder-Policyon/_app/immutable/*never reached the response.Fixes #15862
Solution
generate_headersnow produces the entire_headerscontent:_headers(parse_headers).strip_headers_rules), leaving all other rules and comments untouched.! <name>) so they reliably override colliding user values instead of being comma-joined with them.Non-colliding
_headersfiles are unaffected aside from the autogenerated header lines now using tab indentation consistently.Before submitting the PR, please make sure you have:
pnpm -F @sveltejs/kit test:unitequivalent for the adapter — 20 passing)patch)🤖 Generated with Claude Code