@lovrozagar/flare 0.1.1 → 0.2.0

package/src/link/index.tsx

@@ -1,4 +1,5 @@
-import { createMemo, type JSX, onCleanup, Show, splitProps } from "solid-js";
+import { createEffect, createMemo, createSignal, omit, Show } from "solid-js";
+import type { JSX } from "@solidjs/web";
 import { applyRewriteOutput, isExternal, navigate, prefetch } from "../navigation/index.ts";
 import { useRouterContext } from "../outlet/index.tsx";
 import type { RouteParamsProps, RoutePaths, RouteSearchProps } from "../route-builder/register.ts";
@@ -39,7 +40,7 @@ export type ExternalLinkProps = FlareAnchorProps & {
 
 export type LinkProps<TPath extends RoutePaths = RoutePaths> = InternalLinkProps<TPath> | ExternalLinkProps;
 
-/* Flattened internal type for splitProps — avoids TS intersection issues with Omit */
+/* Flattened internal type for omit — avoids TS intersection issues with Omit */
 interface LinkPropsInternal {
 	activeClass?: string;
 	activeProps?: FlareAnchorProps;
@@ -83,7 +84,9 @@ function isDangerousHref(href: string): boolean {
 export function Link<TPath extends RoutePaths>(props: LinkProps<TPath>): JSX.Element {
 	const ctx = useRouterContext();
 
-	const [local, rest] = splitProps(props as unknown as LinkPropsInternal, [
+	const local = props as unknown as LinkPropsInternal;
+	const rest = omit(
+		local,
 		"activeClass",
 		"activeProps",
 		"children",
@@ -107,19 +110,24 @@ export function Link<TPath extends RoutePaths>(props: LinkProps<TPath>): JSX.Ele
 		"target",
 		"to",
 		"viewTransition",
-	]);
+	);
 
-	const resolvedHref = createMemo(() => {
-		if (local.href !== undefined) {
-			if (isDangerousHref(local.href)) return "#";
-			return local.href;
-		}
-		const raw = buildUrl({
+	const internalHref = createMemo(() => {
+		if (local.href !== undefined) return undefined;
+		return buildUrl({
 			hash: local.hash,
 			params: local.params,
 			search: local.search,
 			to: local.to ?? "",
 		});
+	});
+
+	const resolvedHref = createMemo(() => {
+		if (local.href !== undefined) {
+			if (isDangerousHref(local.href)) return "#";
+			return local.href;
+		}
+		const raw = internalHref() ?? "";
 		if (isDangerousHref(raw)) return "#";
 		return applyRewriteOutput(raw);
 	});
@@ -132,8 +140,8 @@ export function Link<TPath extends RoutePaths>(props: LinkProps<TPath>): JSX.Ele
 
 	const routePrefetch = createMemo(() => {
 		if (local.href !== undefined) return undefined;
-		const h = resolvedHref();
-		if (isExternal(h)) return undefined;
+		const h = internalHref();
+		if (!h || isExternal(h)) return undefined;
 		try {
 			const url = new URL(h, typeof window !== "undefined" ? window.location.href : "http://localhost/");
 			const match = matchRoute(ctx.routeTree, url.pathname, ctx.caseSensitive, toLocaleMatch(ctx.localeConfig));
@@ -226,15 +234,27 @@ export function Link<TPath extends RoutePaths>(props: LinkProps<TPath>): JSX.Ele
 			return;
 		}
 
+		let to = local.to ?? "";
+		let hash = local.hash;
+		if (!local.to && local.href !== undefined) {
+			try {
+				const url = new URL(h, typeof window !== "undefined" ? window.location.href : "http://localhost/");
+				to = url.pathname + url.search;
+				hash = hash ?? (url.hash || undefined);
+			} catch {
+				to = h;
+			}
+		}
+
 		navigate({
-			hash: local.hash,
+			hash,
 			params: local.params,
 			replace: local.replace,
 			revalidate: local.revalidate,
 			scroll: local.scroll,
 			search: local.search,
 			shallow: local.shallow,
-			to: local.to ?? "",
+			to,
 			viewTransition: local.viewTransition,
 		});
 	}
@@ -244,8 +264,14 @@ export function Link<TPath extends RoutePaths>(props: LinkProps<TPath>): JSX.Ele
 		if (local.href !== undefined) return;
 		const h = resolvedHref();
 		if (isExternal(h)) return;
-		/* params + search already resolved into h by resolvedHref() — passing them again would double-apply */
-		prefetch({ to: h });
+		/* params + search already resolved into h by resolvedHref() — passing them again would double-apply.
+		 * Intent prefetches that URL's NDJSON shell. Viewport/render only warm JS once per route. */
+		const strategy = effectivePrefetch();
+		if (strategy === "viewport" || strategy === "render") {
+			prefetch({ modulesOnly: true, to: h });
+		} else {
+			prefetch({ to: h });
+		}
 	}
 
 	function handleIntent(): void {
@@ -288,49 +314,62 @@ export function Link<TPath extends RoutePaths>(props: LinkProps<TPath>): JSX.Ele
 		};
 	}
 
-	function setupPrefetchBehavior(el: HTMLAnchorElement): void {
-		if (local.href !== undefined) return;
-		if (isExternal(resolvedHref())) return;
-
-		const strategy = effectivePrefetch();
-
-		if (strategy === "intent") {
-			el.addEventListener("focus", handleIntent);
-			el.addEventListener("touchstart", handleIntent, { passive: true });
-			onCleanup(() => {
-				el.removeEventListener("focus", handleIntent);
-				el.removeEventListener("touchstart", handleIntent);
-			});
-		}
+	/* Capture the element; attach listeners in createEffect so cleanup is owned. */
+	const [anchor, setAnchor] = createSignal<HTMLAnchorElement | undefined>();
+
+	createEffect(
+		() => {
+			const el = anchor();
+			const strategy = effectivePrefetch();
+			const href = resolvedHref();
+			return {
+				disabled: !!local.disabled,
+				el,
+				external: isExternal(href),
+				hrefOnly: local.href !== undefined,
+				strategy,
+			};
+		},
+		({ disabled, el, external, hrefOnly, strategy }) => {
+			if (!el || disabled || hrefOnly || external) return;
+
+			if (strategy === "intent") {
+				el.addEventListener("focus", handleIntent);
+				el.addEventListener("touchstart", handleIntent, { passive: true });
+				return () => {
+					el.removeEventListener("focus", handleIntent);
+					el.removeEventListener("touchstart", handleIntent);
+				};
+			}
 
-		if (strategy === "viewport") {
-			let observer: IntersectionObserver | undefined;
-			const cancel = scheduleAfterLoad(() => {
-				if (typeof IntersectionObserver === "undefined") return;
-				observer = new IntersectionObserver(
-					(entries) => {
-						for (const entry of entries) {
-							if (entry.isIntersecting) {
-								triggerPrefetch();
-								observer?.unobserve(entry.target);
+			if (strategy === "viewport") {
+				let observer: IntersectionObserver | undefined;
+				const cancel = scheduleAfterLoad(() => {
+					if (typeof IntersectionObserver === "undefined") return;
+					observer = new IntersectionObserver(
+						(entries) => {
+							for (const entry of entries) {
+								if (entry.isIntersecting) {
+									triggerPrefetch();
+									observer?.unobserve(entry.target);
+								}
 							}
-						}
-					},
-					{ threshold: 0 },
-				);
-				observer.observe(el);
-			});
-			onCleanup(() => {
-				cancel();
-				observer?.disconnect();
-			});
-		}
+						},
+						{ threshold: 0 },
+					);
+					observer.observe(el);
+				});
+				return () => {
+					cancel();
+					observer?.disconnect();
+				};
+			}
 
-		if (strategy === "render") {
-			const cancel = scheduleAfterLoad(() => triggerPrefetch());
-			onCleanup(cancel);
-		}
-	}
+			if (strategy === "render") {
+				return scheduleAfterLoad(() => triggerPrefetch());
+			}
+		},
+	);
 
 	function disabledStyle(): JSX.CSSProperties | string {
 		if (typeof local.style === "string") return `cursor:not-allowed;${local.style}`;
@@ -341,7 +380,7 @@ export function Link<TPath extends RoutePaths>(props: LinkProps<TPath>): JSX.Ele
 	return (
 		<Show
 			fallback={
-				<span {...rest} aria-disabled="true" class={classes()} style={disabledStyle()} tabIndex={-1}>
+				<span {...rest} aria-disabled="true" class={classes()} style={disabledStyle()} tabindex={-1}>
 					{local.children}
 				</span>
 			}
@@ -356,7 +395,7 @@ export function Link<TPath extends RoutePaths>(props: LinkProps<TPath>): JSX.Ele
 				href={resolvedHref()}
 				onClick={handleClick}
 				onMouseEnter={handleIntent}
-				ref={setupPrefetchBehavior}
+				ref={setAnchor}
 				rel={effectiveRel()}
 				target={local.target}
 			>

package/src/loader-pipeline/index.ts

@@ -1,5 +1,5 @@
 import type { DeferContext } from "../defer/index.ts";
-import { createDeferContext } from "../defer/index.ts";
+import { containsDeferred, createDeferContext } from "../defer/index.ts";
 import { parseMilliseconds, parseSeconds } from "../duration/index.ts";
 import {
 	isNotFoundError,
@@ -35,7 +35,7 @@ import { buildVaryHeader } from "../server-handler/etag.ts";
 import type { FlareStore } from "../store/index.ts";
 import { noopTracer } from "../tracing/noop.ts";
 import type { FlareTracer } from "../tracing/types.ts";
-import { buildUrl, parseSearchParams, type SearchParams } from "../url/index.ts";
+import { buildUrl, parseSearchParams, serializeSearchParams, type SearchParams } from "../url/index.ts";
 import { isStandardSchema, issuesToFlattenedError } from "../validation/index.ts";
 
 export type { LoaderCause };
@@ -144,6 +144,7 @@ function buildCdnCacheHeaders(cdn: CdnCacheConfig, params: Record<string, string
 }
 
 interface InternalRoute {
+	authenticateError?: Error;
 	authorizeError?: Error;
 	location: Location<Record<string, string | string[]>, SearchParams, string>;
 	preloaderError?: Error;
@@ -153,6 +154,37 @@ interface InternalRoute {
 	validatedSearch: SearchParams;
 }
 
+function defaultSsrCacheKey(
+	virtualPath: string,
+	params: Record<string, string | string[]>,
+	search: SearchParams,
+): string {
+	const base = `flare:${virtualPath}:${JSON.stringify(params)}`;
+	const searchPart = serializeSearchParams(search);
+	return searchPart.length > 0 ? `${base}:${searchPart}` : base;
+}
+
+function isRequiredAuth(route: ResolvedRoute): boolean {
+	return route.authenticate !== undefined && route.authenticateMode !== "optional";
+}
+
+/** Store UnauthenticatedError on the first required-auth route and every subsequent match so loaders skip. */
+function attachUnauthenticated(internalRoutes: InternalRoute[], err: UnauthenticatedError): void {
+	let first = -1;
+	for (let i = 0; i < internalRoutes.length; i++) {
+		const ir = internalRoutes[i];
+		if (ir && isRequiredAuth(ir.route)) {
+			first = i;
+			break;
+		}
+	}
+	if (first < 0) return;
+	for (let j = first; j < internalRoutes.length; j++) {
+		const ir = internalRoutes[j];
+		if (ir) ir.authenticateError = err;
+	}
+}
+
 /** Phase 1: Validate route inputs (params + search) and build location objects. */
 async function buildInternalRoutes(
 	routes: ResolvedRoute[],
@@ -235,38 +267,43 @@ export async function runPipeline<TEnv = unknown>(config: PipelineConfig<TEnv>):
 	const hasAnyAuth = internalRoutes.some((r) => r.route.authenticate !== undefined);
 
 	if (hasAnyAuth) {
+		const hasRequired = internalRoutes.some((r) => isRequiredAuth(r.route));
 		if (!config.authenticateFn) {
-			/* Only throw if at least one route requires auth (not just optional) */
-			const hasRequired = internalRoutes.some(
-				(r) => r.route.authenticate !== undefined && r.route.authenticateMode !== "optional",
-			);
 			if (hasRequired) {
 				authSpan.setStatus("error");
-				authSpan.end();
-				throw new UnauthenticatedError();
+				attachUnauthenticated(internalRoutes, new UnauthenticatedError());
 			}
 		} else {
-			/* find first route with authenticate to get callerData */
 			const firstAuthRoute = internalRoutes.find((r) => r.route.authenticate !== undefined);
-			auth = await config.authenticateFn({
-				callerData: firstAuthRoute?.route.authenticate as unknown[] | undefined,
-				env,
-				request,
-				serverContext: getServerContext(),
-				url,
-			});
-
-			if (auth === null || auth === undefined) {
-				/* Only throw for required auth (true or unset mode), not optional */
-				const hasRequired = internalRoutes.some(
-					(r) => r.route.authenticate !== undefined && r.route.authenticateMode !== "optional",
-				);
-				if (hasRequired) {
+			try {
+				auth = await config.authenticateFn({
+					callerData: firstAuthRoute?.route.authenticate as unknown[] | undefined,
+					env,
+					request,
+					serverContext: getServerContext(),
+					url,
+				});
+			} catch (e: unknown) {
+				if (isRedirectResponse(e) || isNotFoundError(e)) {
+					authSpan.setStatus("error");
+					authSpan.end();
+					throw e;
+				}
+				if (isUnauthenticatedError(e)) {
+					authSpan.setStatus("error");
+					attachUnauthenticated(internalRoutes, e);
+					auth = null;
+				} else {
 					authSpan.setStatus("error");
 					authSpan.end();
-					throw new UnauthenticatedError();
+					throw e;
 				}
 			}
+
+			if (!internalRoutes.some((r) => r.authenticateError) && (auth === null || auth === undefined) && hasRequired) {
+				authSpan.setStatus("error");
+				attachUnauthenticated(internalRoutes, new UnauthenticatedError());
+			}
 		}
 	}
 	authSpan.end();
@@ -292,6 +329,8 @@ export async function runPipeline<TEnv = unknown>(config: PipelineConfig<TEnv>):
 	};
 
 	for (const ir of internalRoutes) {
+		if (ir.authenticateError) continue;
+
 		/* 3a. Preloader */
 		if (ir.route.preloader && !ir.preloaderError) {
 			const preloaderSpan = tracer.startSpan(`flare.pipeline.preloader:${ir.route.virtualPath}`);
@@ -391,6 +430,18 @@ export async function runPipeline<TEnv = unknown>(config: PipelineConfig<TEnv>):
 		const deferContext = createDeferContext(matchId, { prefetch: config.prefetch });
 		deferContexts.set(matchId, deferContext);
 
+		if (ir.authenticateError) {
+			return {
+				deferContext,
+				error: ir.authenticateError,
+				loaderData: undefined,
+				matchId,
+				preloaderContext: ir.preloaderSnapshot,
+				route: ir.route,
+				status: "error",
+			};
+		}
+
 		/* Authorize failure stored in phase 3b — skip loader, produce error match */
 		if (ir.authorizeError) {
 			return {
@@ -434,14 +485,17 @@ export async function runPipeline<TEnv = unknown>(config: PipelineConfig<TEnv>):
 		const ssrConfig = ir.route.cache?.ssr ?? ssrCacheDefaults;
 		let cacheKey: string | undefined;
 		if (ssrConfig && resolvedStore) {
-			cacheKey = ssrConfig.key
-				? ssrConfig.key({ params: ir.validatedParams })
-				: `flare:${ir.route.virtualPath}:${JSON.stringify(ir.validatedParams)}`;
+			const personalized = ir.route.authenticateMode === true || ir.route.authenticateMode === "optional";
+			if (ssrConfig.key) {
+				cacheKey = ssrConfig.key({ auth, params: ir.validatedParams, search });
+			} else if (!personalized) {
+				cacheKey = defaultSsrCacheKey(ir.route.virtualPath, ir.validatedParams, search);
+			}
 		}
 		if (ssrConfig && resolvedStore && cacheKey) {
 			try {
 				const cached = await resolvedStore.get(cacheKey);
-				if (cached) {
+				if (cached && !containsDeferred(cached.data)) {
 					const isFresh =
 						ssrConfig.staleTime === undefined || Date.now() - cached.storedAt < parseMilliseconds(ssrConfig.staleTime);
 					if (isFresh) {
@@ -488,20 +542,24 @@ export async function runPipeline<TEnv = unknown>(config: PipelineConfig<TEnv>):
 			if (config.queryClient) {
 				loaderCtx.queryClient = config.queryClient;
 			}
+			const startedAt = Date.now();
 			const loaderData = await ir.route.loader(loaderCtx);
 
-			/* Store cache write-back */
-			if (ssrConfig && resolvedStore && cacheKey) {
+			/* Store cache write-back — skip deferred trees (markers have no live promises) */
+			if (ssrConfig && resolvedStore && cacheKey && !containsDeferred(loaderData)) {
 				let tags: string[] | undefined;
 				if (ssrConfig.tags) {
 					tags = typeof ssrConfig.tags === "function" ? ssrConfig.tags({ params: ir.validatedParams }) : ssrConfig.tags;
 				}
 				try {
-					await resolvedStore.set(
-						cacheKey,
-						{ data: serializeLoaderData(loaderData), storedAt: Date.now(), tags },
-						ssrConfig.ttl !== undefined ? parseSeconds(ssrConfig.ttl) : undefined,
-					);
+					const existing = await resolvedStore.get(cacheKey);
+					if (!existing || existing.storedAt < startedAt) {
+						await resolvedStore.set(
+							cacheKey,
+							{ data: serializeLoaderData(loaderData), storedAt: startedAt, tags },
+							ssrConfig.ttl !== undefined ? parseSeconds(ssrConfig.ttl) : undefined,
+						);
+					}
 				} catch (e: unknown) {
 					warn("cache", "Store set failed", e);
 				}

package/src/locale/cookie.ts

@@ -0,0 +1,15 @@
+const DEFAULT_COOKIE_NAME = "flare.locale";
+const COOKIE_NAME_RE = /^[\w.-]+$/;
+
+export function formatLocaleCookie(
+	locale: string,
+	cookieName: string = DEFAULT_COOKIE_NAME,
+	opts?: { https?: boolean; maxAge?: number; secure?: boolean },
+): string {
+	const name = COOKIE_NAME_RE.test(cookieName) ? cookieName : DEFAULT_COOKIE_NAME;
+	const safe = locale.replace(/[\r\n;\0]/g, "");
+	const maxAge = opts?.maxAge ?? 31_536_000;
+	const useSecure = opts?.secure ?? opts?.https ?? false;
+	const secureFlag = useSecure ? "; Secure" : "";
+	return `${name}=${safe}; Path=/; Max-Age=${maxAge}; SameSite=Lax${secureFlag}`;
+}

package/src/locale/index.tsx

@@ -1,16 +1,8 @@
-import {
-	createContext,
-	createEffect,
-	createSignal,
-	type JSX,
-	on,
-	onCleanup,
-	onMount,
-	sharedConfig,
-	useContext,
-} from "solid-js";
+import { createContext, createEffect, createSignal, onSettled, untrack, useContext } from "solid-js";
+import type { JSX } from "@solidjs/web";
 import { BroadcastCtx } from "../broadcast/context.ts";
 import { escapeJsString } from "../theme/index.tsx";
+import { formatLocaleCookie } from "./cookie.ts";
 
 /* ── Types ─────────────────────────────────────────────────────────── */
 
@@ -24,6 +16,8 @@ export interface LocaleConfig {
 	syncDirection?: boolean;
 }
 
+export { formatLocaleCookie } from "./cookie.ts";
+
 export interface LocaleContextValue {
 	defaultLocale: string;
 	locale: () => string;
@@ -40,52 +34,47 @@ export function getLocaleScript(opts: LocaleConfig): string {
 
 /* ── Context ───────────────────────────────────────────────────────── */
 
-const LocaleCtx = createContext<LocaleContextValue>();
+const LocaleCtx = createContext<LocaleContextValue | null>(null);
 
 export function LocaleProvider(props: { children: JSX.Element; config: LocaleConfig; initial?: string }): JSX.Element {
-	if (sharedConfig.context) {
-		return props.children;
-	}
-
-	const cfg = props.config;
+	const cfg = untrack(() => props.config);
 	const defaultLocale = cfg.defaultLocale;
 	const cookieName = cfg.cookieName ?? "flare.locale";
 
-	/* Capture context at component setup level (not inside onMount) */
+	/* Capture context at component setup level (not inside onSettled) */
 	const channel = cfg.broadcast ? useContext(BroadcastCtx) : undefined;
 
 	/* URL is truth: initial comes from server (URL params), not localStorage */
-	const initial = props.initial ?? defaultLocale;
+	const initial = untrack(() => props.initial) ?? defaultLocale;
 	const [locale, setLocaleSignal] = createSignal(initial);
 
 	/* Cross-tab sync: BroadcastChannel for locale (opt-in) */
-	onMount(() => {
+	onSettled(() => {
 		if (!channel) return;
 
-		const unsubscribe = channel.onMessage((msg) => {
+		return channel.onMessage((msg) => {
 			if (msg.type === "locale" && typeof msg.value === "string" && cfg.locales.includes(msg.value)) {
 				setLocaleSignal(msg.value);
 			}
 		});
+	});
 
+	if (channel) {
 		createEffect(
-			on(
-				locale,
-				(l) => {
-					channel.broadcast({ type: "locale", value: l });
-				},
-				{ defer: true },
-			),
+			locale,
+			(l) => {
+				channel.broadcast({ type: "locale", value: l });
+			},
+			{ defer: true },
 		);
+	}
 
-		onCleanup(unsubscribe);
-	});
-
-	createEffect(() => {
-		const l = locale();
+	createEffect(locale, (l) => {
 		if (typeof document === "undefined") return;
 		document.documentElement.setAttribute("lang", l);
-		document.cookie = `${cookieName}=${l}; path=/; max-age=31536000; samesite=lax`;
+		document.cookie = formatLocaleCookie(l, cookieName, {
+			https: typeof location !== "undefined" && location.protocol === "https:",
+		});
 	});
 
 	const setLocale = (l: string): void => {
@@ -100,7 +89,7 @@ export function LocaleProvider(props: { children: JSX.Element; config: LocaleCon
 		setLocale,
 	};
 
-	return <LocaleCtx.Provider value={value}>{props.children}</LocaleCtx.Provider>;
+	return <LocaleCtx value={value}>{props.children}</LocaleCtx>;
 }
 
 export function useLocale(): LocaleContextValue {

package/src/locale.ts

@@ -1,3 +1,4 @@
 export { LocaleScript } from "./components/locale-script.tsx";
 export type { LocaleConfig, LocaleContextValue } from "./locale/index.tsx";
+export { formatLocaleCookie } from "./locale/cookie.ts";
 export { buildHreflangLinks, getLocaleScript, LocaleProvider, useLocale } from "./locale/index.tsx";

package/src/middleware/builtins/api-proxy.ts

@@ -12,6 +12,57 @@ interface ApiProxyConfig<TEnv = unknown> {
 	target: (ctx: { env: TEnv }) => ServiceBinding;
 }
 
+const HOP_BY_HOP = new Set([
+	"connection",
+	"host",
+	"keep-alive",
+	"proxy-authenticate",
+	"proxy-authorization",
+	"te",
+	"trailer",
+	"trailers",
+	"transfer-encoding",
+	"upgrade",
+]);
+
+function copyForwardHeaders(source: Headers): Headers {
+	const headers = new Headers();
+	const extraHop = new Set<string>();
+	const connection = source.get("connection");
+	if (connection) {
+		for (const name of connection.split(",")) {
+			const trimmed = name.trim().toLowerCase();
+			if (trimmed) extraHop.add(trimmed);
+		}
+	}
+	for (const [key, value] of source) {
+		const lower = key.toLowerCase();
+		if (HOP_BY_HOP.has(lower) || extraHop.has(lower)) continue;
+		headers.append(key, value);
+	}
+	return headers;
+}
+
+function withNosniff(response: Response): Response {
+	if (response.headers.get("X-Content-Type-Options")) return response;
+	const headers = new Headers(response.headers);
+	headers.set("X-Content-Type-Options", "nosniff");
+	return new Response(response.body, {
+		headers,
+		status: response.status,
+		statusText: response.statusText,
+	});
+}
+
+function bypassText(ctx: MiddlewareContext, body: string, status: number) {
+	return ctx.bypass(
+		new Response(body, {
+			headers: { "X-Content-Type-Options": "nosniff" },
+			status,
+		}),
+	);
+}
+
 export function apiProxy<TEnv = unknown>(config: ApiProxyConfig<TEnv>): FlareMiddleware<TEnv> {
 	return async (ctx: MiddlewareContext<TEnv>) => {
 		/* check enabled */
@@ -35,10 +86,13 @@ export function apiProxy<TEnv = unknown>(config: ApiProxyConfig<TEnv>): FlareMid
 				targetPath = pathname.slice(config.pathPrefix.length) || "/";
 			}
 
-			/* build proxied request */
+			/* build proxied request — rewrite must stay on this origin */
 			const targetUrl = new URL(targetPath, ctx.url.origin);
+			if (targetUrl.origin !== ctx.url.origin) {
+				return bypassText(ctx, "Bad Request", 400);
+			}
 			targetUrl.search = ctx.url.search;
-			const headers = new Headers(ctx.request.headers);
+			const headers = copyForwardHeaders(ctx.request.headers);
 
 			if (config.headers) {
 				const extra = config.headers({ env: ctx.env, request: ctx.request });
@@ -56,9 +110,9 @@ export function apiProxy<TEnv = unknown>(config: ApiProxyConfig<TEnv>): FlareMid
 
 			const service = config.target({ env: ctx.env });
 			const response = await service.fetch(proxyRequest);
-			return ctx.bypass(response);
+			return ctx.bypass(withNosniff(response));
 		} catch {
-			return ctx.bypass(new Response("Bad Gateway", { status: 502 }));
+			return bypassText(ctx, "Bad Gateway", 502);
 		}
 	};
 }