@faststore/core 3.100.3 → 3.100.6

package/.turbo/turbo-build.log

@@ -1,23 +1,23 @@
 
-> @faststore/core@3.100.2 prebuild /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.100.4 prebuild /home/runner/work/faststore/faststore/packages/core
 > na run partytown && na run generate
 
 
-> @faststore/core@3.100.2 partytown /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.100.4 partytown /home/runner/work/faststore/faststore/packages/core
 > partytown copylib ./public/~partytown
 
 Partytown lib copied to: /home/runner/work/faststore/faststore/packages/core/public/~partytown
 
-> @faststore/core@3.100.2 generate /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.100.4 generate /home/runner/work/faststore/faststore/packages/core
 > na run generate:schema && na run generate:codegen && na run format:generated
 
 
-> @faststore/core@3.100.2 generate:schema /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.100.4 generate:schema /home/runner/work/faststore/faststore/packages/core
 > tsx src/server/generator/generateGraphQLSchemaFile.ts
 
 Schema GraphQL file generated successfully
 
-> @faststore/core@3.100.2 generate:codegen /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.100.4 generate:codegen /home/runner/work/faststore/faststore/packages/core
 > graphql-codegen
 
 [STARTED] Parse Configuration
@@ -37,11 +37,11 @@ Running lifecycle hook "afterStart" scripts...
 [CLI] Loading Documents
 [CLI] Generating output
 
-> @faststore/core@3.100.2 format:generated /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.100.4 format:generated /home/runner/work/faststore/faststore/packages/core
 > prettier --write "@generated/**/*.{ts,js,tsx,jsx,json}" --loglevel error
 
 
-> @faststore/core@3.100.2 build /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.100.4 build /home/runner/work/faststore/faststore/packages/core
 > next build
 
 ⚠ No build cache found. Please configure build caching for faster rebuilds. Read more: https://nextjs.org/docs/messages/no-cache
@@ -58,7 +58,7 @@ Browserslist: caniuse-lite is outdated. Please run:
    Creating an optimized production build ...
    Disabled SWC as replacement for Babel because of custom Babel configuration ".babelrc.js" https://nextjs.org/docs/messages/swc-disabled
    Using external babel configuration from /home/runner/work/faststore/faststore/packages/core/.babelrc.js
-Browserslist: browsers data (caniuse-lite) is 17 months old. Please run:
+Browserslist: browsers data (caniuse-lite) is 21 months old. Please run:
   npx update-browserslist-db@latest
   Why you should do it regularly: https://github.com/browserslist/update-db#readme
 <w> [webpack.cache.PackFileCacheStrategy] Skipped not serializable cache item 'Compilation/modules|/home/runner/work/faststore/faststore/node_modules/.pnpm/next@13.5.11_@babel+core@7.26.7_@opentelemetry+api@1.4.1_react-dom@18.3.1_react@18.3.1__react@18.3.1_sass@1.83.4/node_modules/next/dist/build/webpack/loaders/css-loader/src/index.js??ruleSet[1].rules[7].oneOf[9].use[1]!/home/runner/work/faststore/faststore/node_modules/.pnpm/next@13.5.11_@babel+core@7.26.7_@opentelemetry+api@1.4.1_react-dom@18.3.1_react@18.3.1__react@18.3.1_sass@1.83.4/node_modules/next/dist/build/webpack/loaders/postcss-loader/src/index.js??ruleSet[1].rules[7].oneOf[9].use[2]!/home/runner/work/faststore/faststore/node_modules/.pnpm/next@13.5.11_@babel+core@7.26.7_@opentelemetry+api@1.4.1_react-dom@18.3.1_react@18.3.1__react@18.3.1_sass@1.83.4/node_modules/next/dist/build/webpack/loaders/resolve-url-loader/index.js??ruleSet[1].rules[7].oneOf[9].use[3]!/home/runner/work/faststore/faststore/node_modules/.pnpm/next@13.5.11_@babel+core@7.26.7_@opentelemetry+api@1.4.1_react-dom@18.3.1_react@18.3.1__react@18.3.1_sass@1.83.4/node_modules/next/dist/compiled/sass-loader/cjs.js??ruleSet[1].rules[7].oneOf[9].use[4]!/home/runner/work/faststore/faststore/packages/core/src/components/common/Toast/section.module.scss': No serializer registered for Warning
@@ -154,7 +154,7 @@ Route (pages)                              Size     First Load JS
   ├ chunks/framework-d514426edf885c68.js   45.4 kB
   ├ chunks/main-a2d1cfe626f2fef1.js        33.4 kB
   ├ chunks/pages/_app-35e8dda638ee2672.js  26.6 kB
-  ├ chunks/webpack-25c67512e1907efd.js     3.9 kB
+  ├ chunks/webpack-6a844a3f6a390f62.js     3.9 kB
   └ css/146a8678babc61bf.css               9.2 kB
 
 ƒ Middleware                               44.8 kB

package/.turbo/turbo-test.log

@@ -1,20 +1,22 @@
 
-> @faststore/core@3.100.2 test /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.100.4 test /home/runner/work/faststore/faststore/packages/core
 > jest
 
-PASS test/utils/clearCookies.test.ts (9.746 s)
+PASS test/utils/clearCookies.test.ts (13.987 s)
+PASS test/server/password-protection-service.test.ts (18.623 s)
+PASS test/utils/cookieCacheBusting.test.ts (16.597 s)
 PASS test/utils/multipleTemplates.test.ts
-PASS test/server/password-protection-service.test.ts (16.656 s)
-PASS test/utils/cookieCacheBusting.test.ts (15.853 s)
-PASS test/server/cms/global.test.ts
+PASS test/sdk/redirects/index.test.ts
+PASS test/utils/trustedForwardedHost.test.ts
 PASS test/utils/validateSessionRefreshToken.test.ts
+PASS test/server/cms/global.test.ts
 PASS test/utils/isLocalHost.test.ts
-PASS test/server/cms/index.test.ts
 PASS test/utils/isLocalHost.browser.test.ts
-PASS test/server/index.test.ts (11.788 s)
+PASS test/server/cms/index.test.ts (5.82 s)
+PASS test/server/index.test.ts (10.891 s)
 
-Test Suites: 10 passed, 10 total
-Tests:       85 passed, 85 total
+Test Suites: 12 passed, 12 total
+Tests:       119 passed, 119 total
 Snapshots:   0 total
-Time:        27.32 s
+Time:        30.388 s
 Ran all test suites.

package/CHANGELOG.md

@@ -3,6 +3,24 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.100.6](https://github.com/vtex/faststore/compare/v3.100.5...v3.100.6) (2026-10-07)
+
+### Bug Fixes
+
+- address security & functional concerns from dk review (3.x backport) ([c928a1f](https://github.com/vtex/faststore/commit/c928a1fc04bc3554d83302c4cf760adab0f7e81c))
+- **core:** harden x-forwarded-host handling and drop orderNumber fallback ([55990c1](https://github.com/vtex/faststore/commit/55990c1c6208c06ae482e71816df2035292bf2e9)), closes [#3178](https://github.com/vtex/faststore/issues/3178)
+- **core:** ignore multi-value x-forwarded-host and cover port and case ([81ba26b](https://github.com/vtex/faststore/commit/81ba26b93175878b9cc3e32683f9c13b0abf25e9))
+- **core:** log ignored x-forwarded-host and cover CR/LF hostnames ([e6a326f](https://github.com/vtex/faststore/commit/e6a326f6d0d4a91c75b9f0a10abfdc7c22c897be))
+- **core:** make preview cookies host-only instead of rewriting their domain ([989fc69](https://github.com/vtex/faststore/commit/989fc69c573c980e354d11e3c3d8a719e2833fb2))
+- **core:** reject hostnames that would inject Set-Cookie attributes ([109d819](https://github.com/vtex/faststore/commit/109d81917e1200dd78b9500f4cb81d128c78003d))
+- resolve ValidateCartMutation infinite loop in preview environments (SFS-3034) ([ad7800d](https://github.com/vtex/faststore/commit/ad7800d65493c7477c9fb30119f76925647c40fc)), closes [#3178](https://github.com/vtex/faststore/issues/3178) [#3178](https://github.com/vtex/faststore/issues/3178) [#3190](https://github.com/vtex/faststore/issues/3190) [#3188](https://github.com/vtex/faststore/issues/3188) [#1467584](https://github.com/vtex/faststore/issues/1467584)
+
+## [3.100.4](https://github.com/vtex/faststore/compare/v3.100.3...v3.100.4) (2026-08-28)
+
+### Bug Fixes
+
+- **core:** resolve redirect matcher module explicitly ([#3468](https://github.com/vtex/faststore/issues/3468)) ([fe3a3c7](https://github.com/vtex/faststore/commit/fe3a3c7c19237d53061be7b205838b626e225786)), closes [#3467](https://github.com/vtex/faststore/issues/3467) [#1450148](https://github.com/vtex/faststore/issues/1450148)
+
 ## [3.100.3](https://github.com/vtex/faststore/compare/v3.100.2...v3.100.3) (2026-06-30)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faststore/core",
-  "version": "3.100.3",
+  "version": "3.100.6",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -127,5 +127,5 @@
     "ts-jest": "29.1.1",
     "typescript": "5.3.2"
   },
-  "gitHead": "bf4812f3e3a53108f22ab987098b74f7eed9bfa3"
+  "gitHead": "31df58321c484732bd4a69618e9eb09e6a2c0261"
 }

package/src/pages/api/graphql.ts

@@ -10,6 +10,11 @@ import type { NextApiHandler, NextApiRequest } from 'next'
 import discoveryConfig from 'discovery.config'
 import { getJWTAutCookie } from 'src/utils/getCookie'
 import { isLocalHost } from 'src/utils/isLocalHost'
+import {
+  isHostAllowed,
+  removeCookieDomain,
+  singleForwardedHost,
+} from 'src/utils/trustedForwardedHost'
 import { shouldForceRefreshTokenForValidateSession } from 'src/utils/validateSessionRefreshToken'
 import { execute } from '../../server'
 
@@ -20,24 +25,45 @@ const ALLOWED_HOST_SUFFIXES = ['localhost', '.vtex.app', '.localhost']
 // Example: "Set-Cookie: key=value; Domain=example.com; Path=/"
 const MATCH_DOMAIN_REGEXP = /(?:^|;\s*)(?:domain=)([^;]+)/i
 
+const toHostname = (hostHeader: string | undefined) => {
+  const trimmed = hostHeader?.trim()
+  if (!trimmed) {
+    return null
+  }
+
+  try {
+    return new URL(`https://${trimmed}`).hostname
+  } catch {
+    return null
+  }
+}
+
 /**
- * Extracts hostname from the incoming request.
+ * Extracts hostname from the incoming request. The preview ingress forwards a
+ * client-supplied x-forwarded-host as is, so it only decides whether the cookie
+ * Domain is dropped, never which domain is used. A multi-value header is
+ * ignored; a single value is used only if it is on the allowlist.
  */
 const getRequestHostname = ({
   request,
 }: {
   request: NextApiRequest
 }): string | null => {
-  const hostHeader = request.headers.host?.trim()
-  if (!hostHeader) {
-    return null
+  const forwardedHeader = request.headers['x-forwarded-host']
+  const forwardedHostname = toHostname(singleForwardedHost(forwardedHeader))
+  if (forwardedHeader && !forwardedHostname) {
+    // The value is client-controllable, so it is not logged.
+    console.warn('Ignoring multi-value or malformed x-forwarded-host')
   }
 
-  try {
-    return new URL(`https://${hostHeader}`).hostname
-  } catch {
-    return null
+  if (
+    forwardedHostname &&
+    isHostAllowed(forwardedHostname, ALLOWED_HOST_SUFFIXES)
+  ) {
+    return forwardedHostname
   }
+
+  return toHostname(request.headers.host)
 }
 
 /**
@@ -57,22 +83,10 @@ const shouldReplaceCookieDomain = ({
 }
 
 /**
- * Determines if host is eligible for domain normalization.
- */
-const isAllowedHost = ({
-  host,
-  allowList,
-}: {
-  host: string
-  allowList: string[]
-}) => {
-  const normalizedHost = host.toLowerCase()
-
-  return allowList.some((suffix) => normalizedHost.endsWith(suffix))
-}
-
-/**
- * Ensure the cookie domain matches the current host so the browser can store it.
+ * On allowlisted hosts (previews, localhost) the upstream cookie domain does not
+ * match the browser host, so the Domain attribute is dropped and the cookie
+ * becomes host-only. The host is never written into the cookie, so a forged
+ * x-forwarded-host cannot choose the cookie scope.
  */
 const normalizeSetCookieDomain = ({
   request,
@@ -93,13 +107,13 @@ const normalizeSetCookieDomain = ({
   const cookieDomain = domainMatch[1]
 
   if (
-    !isAllowedHost({ host, allowList: ALLOWED_HOST_SUFFIXES }) ||
+    !isHostAllowed(host, ALLOWED_HOST_SUFFIXES) ||
     !shouldReplaceCookieDomain({ cookieDomain, host })
   ) {
     return setCookie
   }
 
-  return setCookie.replace(MATCH_DOMAIN_REGEXP, `; domain=${host}`)
+  return removeCookieDomain(setCookie)
 }
 
 const parseRequest = (request: NextApiRequest) => {

package/src/sdk/redirects/index.ts

@@ -1,5 +1,5 @@
 import storeConfig from 'discovery.config'
-import { matcher } from 'src/customizations/src/redirects'
+import { matcher } from 'src/customizations/src/redirects/index'
 
 type GetRedirectArgs = {
   pathname: string
@@ -19,6 +19,23 @@ const PERMANENT_STATUS = 308
 
 const ASSET_FILE_REGEX = /\.(js|css|png|jpg|jpeg|svg|gif|webp|ico|json|map)$/i
 
+let hasWarnedInvalidMatcher = false
+
+function resolveLocalMatch(pathname: string) {
+  if (typeof matcher === 'function') {
+    return matcher({ pathname })
+  }
+
+  if (!hasWarnedInvalidMatcher) {
+    hasWarnedInvalidMatcher = true
+    console.warn(
+      `[redirects] Expected src/redirects to export a \`matcher\` function, got ${typeof matcher}. Falling back to the platform redirect lookup.`
+    )
+  }
+
+  return null
+}
+
 export async function getRedirect({
   pathname,
 }: GetRedirectArgs): Promise<GetRedirectReturn> {
@@ -29,7 +46,8 @@ export async function getRedirect({
   }
 
   try {
-    const redirectMatch = matcher({ pathname })
+    const redirectMatch = resolveLocalMatch(pathname)
+
     if (redirectMatch) {
       return {
         destination: encodeURI(redirectMatch.destination),

package/src/utils/trustedForwardedHost.ts

@@ -0,0 +1,50 @@
+// The result is written verbatim into a Set-Cookie Domain attribute, so
+// characters such as ";" or spaces would inject cookie attributes.
+const HOSTNAME_PATTERN = /^[a-z0-9.-]+$/
+
+/**
+ * An entry starting with "." matches subdomains only; any other entry matches
+ * the host itself and its subdomains. Matching is anchored on a label boundary,
+ * so "evil-localhost" never matches "localhost".
+ */
+export function isHostAllowed(host: string, allowList: string[]) {
+  const normalizedHost = host.toLowerCase()
+
+  if (!HOSTNAME_PATTERN.test(normalizedHost)) {
+    return false
+  }
+
+  return allowList.some((entry) =>
+    entry.startsWith('.')
+      ? normalizedHost.endsWith(entry)
+      : normalizedHost === entry || normalizedHost.endsWith(`.${entry}`)
+  )
+}
+
+/**
+ * Returns the `x-forwarded-host` value only when exactly one is present.
+ *
+ * Which hop of a proxy chain is trustworthy is not known here: with several
+ * values the leftmost one is whatever the client sent. So a multi-value header
+ * (comma-joined by Node, or an array) is ignored and the caller falls back to
+ * `host`. A single value still assumes the ingress overwrites the header.
+ */
+export function singleForwardedHost(
+  header: string | string[] | undefined
+): string | undefined {
+  if (Array.isArray(header)) {
+    return header.length === 1 ? singleForwardedHost(header[0]) : undefined
+  }
+
+  const value = header?.trim()
+
+  return value && !value.includes(',') ? value : undefined
+}
+
+/**
+ * Drops every Domain attribute so the cookie becomes host-only: the browser
+ * scopes it to the exact host it requested, whatever header picked this path.
+ */
+export function removeCookieDomain(setCookie: string): string {
+  return setCookie.replaceAll(/;\s*domain=[^;]*/gi, '')
+}

package/test/sdk/redirects/index.test.ts

@@ -0,0 +1,134 @@
+const STORE_ID = 'teststore'
+const REWRITER_URL = `https://${STORE_ID}.myvtex.com/_v/public/redirect-evaluate`
+
+const MATCHER_MODULE = 'src/customizations/src/redirects/index'
+
+type GetRedirect = typeof import('../../../src/sdk/redirects').getRedirect
+
+async function loadGetRedirect(matcherExport?: unknown): Promise<GetRedirect> {
+  jest.resetModules()
+
+  jest.doMock('discovery.config', () => ({
+    __esModule: true,
+    default: { api: { storeId: STORE_ID } },
+  }))
+
+  if (matcherExport === undefined) {
+    jest.dontMock(MATCHER_MODULE)
+  } else {
+    jest.doMock(MATCHER_MODULE, () => ({
+      __esModule: true,
+      matcher: matcherExport,
+    }))
+  }
+
+  const { getRedirect } = await import('../../../src/sdk/redirects')
+
+  return getRedirect
+}
+
+function mockRewriter({ ok, body }: { ok: boolean; body?: unknown }) {
+  const fetchMock = jest
+    .fn()
+    .mockResolvedValue({ ok, json: async () => body } as Response)
+
+  globalThis.fetch = fetchMock as unknown as typeof fetch
+
+  return fetchMock
+}
+
+describe('getRedirect', () => {
+  const originalFetch = globalThis.fetch
+
+  beforeEach(() => {
+    jest.spyOn(console, 'error').mockImplementation(() => undefined)
+    jest.spyOn(console, 'warn').mockImplementation(() => undefined)
+  })
+
+  afterEach(() => {
+    globalThis.fetch = originalFetch
+    jest.dontMock('discovery.config')
+    jest.dontMock(MATCHER_MODULE)
+    jest.restoreAllMocks()
+    jest.resetModules()
+  })
+
+  it('skips asset paths without querying the rewriter', async () => {
+    const fetchMock = mockRewriter({ ok: false })
+    const getRedirect = await loadGetRedirect()
+
+    await expect(getRedirect({ pathname: '/icons.json' })).resolves.toBeNull()
+    expect(fetchMock).not.toHaveBeenCalled()
+  })
+
+  it('returns a custom matcher result without querying the rewriter', async () => {
+    const fetchMock = mockRewriter({ ok: false })
+    const getRedirect = await loadGetRedirect(() => ({
+      destination: '/promoção',
+      permanent: false,
+    }))
+
+    await expect(getRedirect({ pathname: '/sale' })).resolves.toEqual({
+      destination: encodeURI('/promoção'),
+      permanent: false,
+    })
+    expect(fetchMock).not.toHaveBeenCalled()
+    expect(console.warn).not.toHaveBeenCalled()
+  })
+
+  it('falls back to the rewriter when the matcher export is not a function', async () => {
+    const fetchMock = mockRewriter({
+      ok: true,
+      body: { location: '/eletrodomesticos', status: 308 },
+    })
+    // A store shipping `src/redirects.json` can shadow the customization
+    // module, which makes the imported `matcher` an array instead of a function.
+    const getRedirect = await loadGetRedirect([])
+
+    await expect(getRedirect({ pathname: '/old-page' })).resolves.toEqual({
+      destination: '/eletrodomesticos',
+      permanent: true,
+    })
+    expect(fetchMock).toHaveBeenCalledWith(`${REWRITER_URL}/old-page`)
+    expect(console.warn).toHaveBeenCalledTimes(1)
+  })
+
+  it('warns only once about an invalid matcher export', async () => {
+    mockRewriter({ ok: false })
+    const getRedirect = await loadGetRedirect([])
+
+    await getRedirect({ pathname: '/first' })
+    await getRedirect({ pathname: '/second' })
+
+    expect(console.warn).toHaveBeenCalledTimes(1)
+  })
+
+  it('does not leak a mocked matcher into a later default load', async () => {
+    mockRewriter({ ok: false })
+
+    const withInvalidMatcher = await loadGetRedirect([])
+    await expect(withInvalidMatcher({ pathname: '/first' })).resolves.toBeNull()
+
+    const withStubMatcher = await loadGetRedirect()
+    await expect(withStubMatcher({ pathname: '/second' })).resolves.toBeNull()
+
+    expect(console.warn).toHaveBeenCalledTimes(1)
+  })
+
+  it('marks non-permanent rewriter redirects as temporary', async () => {
+    mockRewriter({ ok: true, body: { location: '/new', status: 307 } })
+    const getRedirect = await loadGetRedirect()
+
+    await expect(getRedirect({ pathname: '/old' })).resolves.toEqual({
+      destination: '/new',
+      permanent: false,
+    })
+  })
+
+  it('returns null when the rewriter has no rule for the path', async () => {
+    mockRewriter({ ok: false })
+    const getRedirect = await loadGetRedirect()
+
+    await expect(getRedirect({ pathname: '/no-rule' })).resolves.toBeNull()
+  })
+})

package/test/utils/trustedForwardedHost.test.ts

@@ -0,0 +1,103 @@
+import {
+  singleForwardedHost,
+  isHostAllowed,
+  removeCookieDomain,
+} from '../../src/utils/trustedForwardedHost'
+
+const ALLOW_LIST = ['localhost', '.vtex.app', '.localhost']
+
+describe('isHostAllowed', () => {
+  it.each([
+    'localhost',
+    'store.vtex.app',
+    'sfj-1--acc.preview.vtex.app',
+    'a.localhost',
+  ])('allows %s', (host: string) => {
+    expect(isHostAllowed(host, ALLOW_LIST)).toBe(true)
+  })
+
+  it.each([
+    'evil-localhost',
+    'notlocalhost',
+    'evil-vtex.app',
+    'vtex.app.evil.com',
+    'evil.com',
+  ])('rejects %s', (host: string) => {
+    expect(isHostAllowed(host, ALLOW_LIST)).toBe(false)
+  })
+})
+
+describe('isHostAllowed normalization', () => {
+  it('is case-insensitive', () => {
+    expect(isHostAllowed('Store.VTEX.app', ALLOW_LIST)).toBe(true)
+    expect(isHostAllowed('LOCALHOST', ALLOW_LIST)).toBe(true)
+  })
+
+  it.each([
+    'x;max-age=0;y.vtex.app',
+    'a b.vtex.app',
+    'x"y.vtex.app',
+    'x=y.vtex.app',
+    'x,y.vtex.app',
+    'x\r\nSet-Cookie: evil=1.vtex.app',
+    'x\ny.vtex.app',
+    'x\ry.vtex.app',
+  ])('rejects %s, which would inject cookie attributes', (host: string) => {
+    expect(isHostAllowed(host, ALLOW_LIST)).toBe(false)
+  })
+
+  it('accepts punycode hostnames', () => {
+    expect(isHostAllowed('xn--lja-bma.vtex.app', ALLOW_LIST)).toBe(true)
+  })
+
+  it('expects a hostname: a port is not stripped here', () => {
+    expect(isHostAllowed('store.vtex.app:8080', ALLOW_LIST)).toBe(false)
+    expect(isHostAllowed('evil.com:vtex.app', ALLOW_LIST)).toBe(false)
+  })
+})
+
+describe('singleForwardedHost', () => {
+  it('returns the value when there is exactly one', () => {
+    expect(singleForwardedHost('a.vtex.app')).toBe('a.vtex.app')
+    expect(singleForwardedHost(' a.vtex.app ')).toBe('a.vtex.app')
+    expect(singleForwardedHost(['a.vtex.app'])).toBe('a.vtex.app')
+  })
+
+  it('returns undefined when missing or empty', () => {
+    expect(singleForwardedHost(undefined)).toBeUndefined()
+    expect(singleForwardedHost('')).toBeUndefined()
+    expect(singleForwardedHost([])).toBeUndefined()
+  })
+
+  it('ignores multi-value headers instead of picking one', () => {
+    expect(singleForwardedHost('a.vtex.app, evil.com')).toBeUndefined()
+    expect(singleForwardedHost('evil.com, a.vtex.app')).toBeUndefined()
+    expect(singleForwardedHost(['a.vtex.app', 'evil.com'])).toBeUndefined()
+  })
+})
+
+describe('removeCookieDomain', () => {
+  it('drops the Domain attribute and keeps the rest', () => {
+    expect(
+      removeCookieDomain(
+        'checkout.vtex.com=__ofid=abc; expires=Sun, 04 Apr 2027 18:31:26 GMT; domain=acc.vtexcommercestable.com.br; path=/; secure; samesite=lax; httponly'
+      )
+    ).toBe(
+      'checkout.vtex.com=__ofid=abc; expires=Sun, 04 Apr 2027 18:31:26 GMT; path=/; secure; samesite=lax; httponly'
+    )
+  })
+
+  it('is case-insensitive and removes repeated Domain attributes', () => {
+    expect(removeCookieDomain('a=1; Domain=x.com; DOMAIN=y.com; Path=/')).toBe(
+      'a=1; Path=/'
+    )
+  })
+
+  it('does not touch a cookie whose name is domain', () => {
+    expect(removeCookieDomain('domain=1; path=/')).toBe('domain=1; path=/')
+  })
+
+  it('keeps cookies without a Domain attribute unchanged', () => {
+    expect(removeCookieDomain('a=1; path=/')).toBe('a=1; path=/')
+  })
+})