Added middleware header #1087
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -2,13 +2,14 @@ import { next } from '@vercel/functions'; | |
| import { projectRegex } from './src/shared/projectRegex'; | ||
|
|
||
| const FETCH_TIMEOUT_MS = 2000; | ||
| const DESCOPE_MIDDLEWARE_HEADER = 'x-descope-middleware'; | ||
|
Member
There was a problem hiding this comment. I don't think we really need this - it's always false with the x-frame-header and always true otherwise. WDYT? |
||
|
|
||
| const getConfigBaseUrl = (url: URL): string => { | ||
| // When accessing the Vercel deployment directly (e.g. for testing), | ||
| // the .well-known endpoint doesn't exist on the Vercel origin. | ||
| // Fall back to the production API for the configuration check. | ||
|
tomski747 marked this conversation as resolved.
|
||
| if (url.hostname.endsWith('.preview.descope.org')) { | ||
| return 'https://api.descope.org'; | ||
|
tomski747 marked this conversation as resolved.
|
||
| } | ||
|
tomski747 marked this conversation as resolved.
|
||
| return url.origin; | ||
| }; | ||
|
|
@@ -36,7 +37,7 @@ const middleware = async (request: Request) => { | |
| const projectConfig = await response.json(); | ||
| if (projectConfig.allowAuthHostingIframeEmbedding === true) { | ||
| // Project explicitly allows iframe embedding — omit X-Frame-Options | ||
| return next({ headers: { [DESCOPE_MIDDLEWARE_HEADER]: 'true' } }); | ||
|
tomski747 marked this conversation as resolved.
|
||
| } | ||
| } | ||
| } catch { | ||
|
|
@@ -49,6 +50,7 @@ const middleware = async (request: Request) => { | |
| // Default: add X-Frame-Options to prevent clickjacking | ||
| return next({ | ||
| headers: { | ||
| [DESCOPE_MIDDLEWARE_HEADER]: 'false', | ||
| 'X-Frame-Options': 'SAMEORIGIN' | ||
| } | ||
|
Comment on lines
51
to
55
There was a problem hiding this comment. Default response headers now include |
||
| }); | ||
|
|
||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🟠 HIGH: Tests not updated — all assertions will fail.
The test file
src/middleware.test.tswas not modified in this PR, but every assertion is now stale:"Embedding allowed" path (lines 85, 97): Tests assert
expect(mockedNext).toHaveBeenCalledWith()(zero args), but the code now passesnext({ headers: { 'x-descope-middleware': 'true' } }). These two tests will fail.expectXFrameOptionshelper (lines 22-26): Assertsnext()is called with{ headers: { 'X-Frame-Options': 'SAMEORIGIN' } }, but the code now also includes'x-descope-middleware': 'false'in the headers object.toHaveBeenCalledWithdoes an exact match on the argument shape, so every test using this helper will fail (6+ tests).Preview URL tests (lines 160-162, 175-177): Assert
api.descope.comin the fetch URL, but the code now usesapi.descope.org. Both config-base-URL tests will fail.Please update
src/middleware.test.tsto match the new behavior.