Files
vercel__workflow/.changeset/webhook-request-passthrough.md
Nathan Rajlich 0d6ec43877 Pass the webhook request through without buffering its body (#3166)
The Astro and SvelteKit webhook wrappers copied the incoming request via
`normalizeRequest()`, which buffers the whole body with `arrayBuffer()`,
before calling the handler that validates the webhook token. Requests
carrying an unknown token therefore did unnecessary work before being
rejected.

The copy turns out to be unnecessary: both frameworks already hand the
route a standard `Request`, so the webhook wrappers now pass it straight
to the handler. The body is left untouched until `resumeWebhook()` has
accepted the token.

The flow route keeps `normalizeRequest()` for now — it authenticates via
the queue trigger rather than a URL token, so the ordering does not
matter there, and whether the shim is needed at all is a separate
question.

Note that the Astro dev server buffers request bodies upstream of the
route handler, so the new behavior is only observable in built output;
the node adapter and Vercel builds both benefit.
2026-07-28 15:08:33 -07:00

254 B

@workflow/astro, @workflow/sveltekit
@workflow/astro @workflow/sveltekit
patch patch

The generated webhook route now passes the incoming request directly to its handler instead of copying it into a new Request, so the request body is no longer read before the handler runs.