mirror of
https://github.com/cloudflare/vinext.git
synced 2026-09-14 19:04:59 +08:00
Steve Faulkner
7c5ca2f193
* fix: apply middleware request-header overrides to App Route request objects App Route handlers received a tracked NextRequest built from the original request object even when middleware had supplied request-header overrides. That meant headers() saw the middleware-modified view via ALS context, but request.headers inside the route handler still exposed the original Authorization/Cookie headers. Fix: - preserve a clone of the middleware response headers before internal x-middleware-* headers are stripped for response safety - thread that preserved header set into the typed App Route execution module - rebuild the underlying Request with buildRequestHeadersFromMiddlewareResponse() before constructing the tracked NextRequest Also adds an App Route fixture and integration test proving that request.headers and headers() now agree after middleware deletes credential headers and injects a trusted internal header. * chore: trigger fresh CI run for PR #809 * regen snaps --------- Co-authored-by: James <james@eli.cx>