@lovrozagar/flare 0.1.2 → 0.2.0

package/src/loader-pipeline/index.ts

@@ -1,5 +1,5 @@
 import type { DeferContext } from "../defer/index.ts";
-import { createDeferContext } from "../defer/index.ts";
+import { containsDeferred, createDeferContext } from "../defer/index.ts";
 import { parseMilliseconds, parseSeconds } from "../duration/index.ts";
 import {
 	isNotFoundError,
@@ -35,7 +35,7 @@ import { buildVaryHeader } from "../server-handler/etag.ts";
 import type { FlareStore } from "../store/index.ts";
 import { noopTracer } from "../tracing/noop.ts";
 import type { FlareTracer } from "../tracing/types.ts";
-import { buildUrl, parseSearchParams, type SearchParams } from "../url/index.ts";
+import { buildUrl, parseSearchParams, serializeSearchParams, type SearchParams } from "../url/index.ts";
 import { isStandardSchema, issuesToFlattenedError } from "../validation/index.ts";
 
 export type { LoaderCause };
@@ -144,6 +144,7 @@ function buildCdnCacheHeaders(cdn: CdnCacheConfig, params: Record<string, string
 }
 
 interface InternalRoute {
+	authenticateError?: Error;
 	authorizeError?: Error;
 	location: Location<Record<string, string | string[]>, SearchParams, string>;
 	preloaderError?: Error;
@@ -153,6 +154,37 @@ interface InternalRoute {
 	validatedSearch: SearchParams;
 }
 
+function defaultSsrCacheKey(
+	virtualPath: string,
+	params: Record<string, string | string[]>,
+	search: SearchParams,
+): string {
+	const base = `flare:${virtualPath}:${JSON.stringify(params)}`;
+	const searchPart = serializeSearchParams(search);
+	return searchPart.length > 0 ? `${base}:${searchPart}` : base;
+}
+
+function isRequiredAuth(route: ResolvedRoute): boolean {
+	return route.authenticate !== undefined && route.authenticateMode !== "optional";
+}
+
+/** Store UnauthenticatedError on the first required-auth route and every subsequent match so loaders skip. */
+function attachUnauthenticated(internalRoutes: InternalRoute[], err: UnauthenticatedError): void {
+	let first = -1;
+	for (let i = 0; i < internalRoutes.length; i++) {
+		const ir = internalRoutes[i];
+		if (ir && isRequiredAuth(ir.route)) {
+			first = i;
+			break;
+		}
+	}
+	if (first < 0) return;
+	for (let j = first; j < internalRoutes.length; j++) {
+		const ir = internalRoutes[j];
+		if (ir) ir.authenticateError = err;
+	}
+}
+
 /** Phase 1: Validate route inputs (params + search) and build location objects. */
 async function buildInternalRoutes(
 	routes: ResolvedRoute[],
@@ -235,38 +267,43 @@ export async function runPipeline<TEnv = unknown>(config: PipelineConfig<TEnv>):
 	const hasAnyAuth = internalRoutes.some((r) => r.route.authenticate !== undefined);
 
 	if (hasAnyAuth) {
+		const hasRequired = internalRoutes.some((r) => isRequiredAuth(r.route));
 		if (!config.authenticateFn) {
-			/* Only throw if at least one route requires auth (not just optional) */
-			const hasRequired = internalRoutes.some(
-				(r) => r.route.authenticate !== undefined && r.route.authenticateMode !== "optional",
-			);
 			if (hasRequired) {
 				authSpan.setStatus("error");
-				authSpan.end();
-				throw new UnauthenticatedError();
+				attachUnauthenticated(internalRoutes, new UnauthenticatedError());
 			}
 		} else {
-			/* find first route with authenticate to get callerData */
 			const firstAuthRoute = internalRoutes.find((r) => r.route.authenticate !== undefined);
-			auth = await config.authenticateFn({
-				callerData: firstAuthRoute?.route.authenticate as unknown[] | undefined,
-				env,
-				request,
-				serverContext: getServerContext(),
-				url,
-			});
-
-			if (auth === null || auth === undefined) {
-				/* Only throw for required auth (true or unset mode), not optional */
-				const hasRequired = internalRoutes.some(
-					(r) => r.route.authenticate !== undefined && r.route.authenticateMode !== "optional",
-				);
-				if (hasRequired) {
+			try {
+				auth = await config.authenticateFn({
+					callerData: firstAuthRoute?.route.authenticate as unknown[] | undefined,
+					env,
+					request,
+					serverContext: getServerContext(),
+					url,
+				});
+			} catch (e: unknown) {
+				if (isRedirectResponse(e) || isNotFoundError(e)) {
+					authSpan.setStatus("error");
+					authSpan.end();
+					throw e;
+				}
+				if (isUnauthenticatedError(e)) {
+					authSpan.setStatus("error");
+					attachUnauthenticated(internalRoutes, e);
+					auth = null;
+				} else {
 					authSpan.setStatus("error");
 					authSpan.end();
-					throw new UnauthenticatedError();
+					throw e;
 				}
 			}
+
+			if (!internalRoutes.some((r) => r.authenticateError) && (auth === null || auth === undefined) && hasRequired) {
+				authSpan.setStatus("error");
+				attachUnauthenticated(internalRoutes, new UnauthenticatedError());
+			}
 		}
 	}
 	authSpan.end();
@@ -292,6 +329,8 @@ export async function runPipeline<TEnv = unknown>(config: PipelineConfig<TEnv>):
 	};
 
 	for (const ir of internalRoutes) {
+		if (ir.authenticateError) continue;
+
 		/* 3a. Preloader */
 		if (ir.route.preloader && !ir.preloaderError) {
 			const preloaderSpan = tracer.startSpan(`flare.pipeline.preloader:${ir.route.virtualPath}`);
@@ -391,6 +430,18 @@ export async function runPipeline<TEnv = unknown>(config: PipelineConfig<TEnv>):
 		const deferContext = createDeferContext(matchId, { prefetch: config.prefetch });
 		deferContexts.set(matchId, deferContext);
 
+		if (ir.authenticateError) {
+			return {
+				deferContext,
+				error: ir.authenticateError,
+				loaderData: undefined,
+				matchId,
+				preloaderContext: ir.preloaderSnapshot,
+				route: ir.route,
+				status: "error",
+			};
+		}
+
 		/* Authorize failure stored in phase 3b — skip loader, produce error match */
 		if (ir.authorizeError) {
 			return {
@@ -434,14 +485,17 @@ export async function runPipeline<TEnv = unknown>(config: PipelineConfig<TEnv>):
 		const ssrConfig = ir.route.cache?.ssr ?? ssrCacheDefaults;
 		let cacheKey: string | undefined;
 		if (ssrConfig && resolvedStore) {
-			cacheKey = ssrConfig.key
-				? ssrConfig.key({ params: ir.validatedParams })
-				: `flare:${ir.route.virtualPath}:${JSON.stringify(ir.validatedParams)}`;
+			const personalized = ir.route.authenticateMode === true || ir.route.authenticateMode === "optional";
+			if (ssrConfig.key) {
+				cacheKey = ssrConfig.key({ auth, params: ir.validatedParams, search });
+			} else if (!personalized) {
+				cacheKey = defaultSsrCacheKey(ir.route.virtualPath, ir.validatedParams, search);
+			}
 		}
 		if (ssrConfig && resolvedStore && cacheKey) {
 			try {
 				const cached = await resolvedStore.get(cacheKey);
-				if (cached) {
+				if (cached && !containsDeferred(cached.data)) {
 					const isFresh =
 						ssrConfig.staleTime === undefined || Date.now() - cached.storedAt < parseMilliseconds(ssrConfig.staleTime);
 					if (isFresh) {
@@ -488,20 +542,24 @@ export async function runPipeline<TEnv = unknown>(config: PipelineConfig<TEnv>):
 			if (config.queryClient) {
 				loaderCtx.queryClient = config.queryClient;
 			}
+			const startedAt = Date.now();
 			const loaderData = await ir.route.loader(loaderCtx);
 
-			/* Store cache write-back */
-			if (ssrConfig && resolvedStore && cacheKey) {
+			/* Store cache write-back — skip deferred trees (markers have no live promises) */
+			if (ssrConfig && resolvedStore && cacheKey && !containsDeferred(loaderData)) {
 				let tags: string[] | undefined;
 				if (ssrConfig.tags) {
 					tags = typeof ssrConfig.tags === "function" ? ssrConfig.tags({ params: ir.validatedParams }) : ssrConfig.tags;
 				}
 				try {
-					await resolvedStore.set(
-						cacheKey,
-						{ data: serializeLoaderData(loaderData), storedAt: Date.now(), tags },
-						ssrConfig.ttl !== undefined ? parseSeconds(ssrConfig.ttl) : undefined,
-					);
+					const existing = await resolvedStore.get(cacheKey);
+					if (!existing || existing.storedAt < startedAt) {
+						await resolvedStore.set(
+							cacheKey,
+							{ data: serializeLoaderData(loaderData), storedAt: startedAt, tags },
+							ssrConfig.ttl !== undefined ? parseSeconds(ssrConfig.ttl) : undefined,
+						);
+					}
 				} catch (e: unknown) {
 					warn("cache", "Store set failed", e);
 				}

package/src/locale/cookie.ts

@@ -0,0 +1,15 @@
+const DEFAULT_COOKIE_NAME = "flare.locale";
+const COOKIE_NAME_RE = /^[\w.-]+$/;
+
+export function formatLocaleCookie(
+	locale: string,
+	cookieName: string = DEFAULT_COOKIE_NAME,
+	opts?: { https?: boolean; maxAge?: number; secure?: boolean },
+): string {
+	const name = COOKIE_NAME_RE.test(cookieName) ? cookieName : DEFAULT_COOKIE_NAME;
+	const safe = locale.replace(/[\r\n;\0]/g, "");
+	const maxAge = opts?.maxAge ?? 31_536_000;
+	const useSecure = opts?.secure ?? opts?.https ?? false;
+	const secureFlag = useSecure ? "; Secure" : "";
+	return `${name}=${safe}; Path=/; Max-Age=${maxAge}; SameSite=Lax${secureFlag}`;
+}

package/src/locale/index.tsx

@@ -1,16 +1,8 @@
-import {
-	createContext,
-	createEffect,
-	createSignal,
-	type JSX,
-	on,
-	onCleanup,
-	onMount,
-	sharedConfig,
-	useContext,
-} from "solid-js";
+import { createContext, createEffect, createSignal, onSettled, untrack, useContext } from "solid-js";
+import type { JSX } from "@solidjs/web";
 import { BroadcastCtx } from "../broadcast/context.ts";
 import { escapeJsString } from "../theme/index.tsx";
+import { formatLocaleCookie } from "./cookie.ts";
 
 /* ── Types ─────────────────────────────────────────────────────────── */
 
@@ -24,6 +16,8 @@ export interface LocaleConfig {
 	syncDirection?: boolean;
 }
 
+export { formatLocaleCookie } from "./cookie.ts";
+
 export interface LocaleContextValue {
 	defaultLocale: string;
 	locale: () => string;
@@ -40,52 +34,47 @@ export function getLocaleScript(opts: LocaleConfig): string {
 
 /* ── Context ───────────────────────────────────────────────────────── */
 
-const LocaleCtx = createContext<LocaleContextValue>();
+const LocaleCtx = createContext<LocaleContextValue | null>(null);
 
 export function LocaleProvider(props: { children: JSX.Element; config: LocaleConfig; initial?: string }): JSX.Element {
-	if (sharedConfig.context) {
-		return props.children;
-	}
-
-	const cfg = props.config;
+	const cfg = untrack(() => props.config);
 	const defaultLocale = cfg.defaultLocale;
 	const cookieName = cfg.cookieName ?? "flare.locale";
 
-	/* Capture context at component setup level (not inside onMount) */
+	/* Capture context at component setup level (not inside onSettled) */
 	const channel = cfg.broadcast ? useContext(BroadcastCtx) : undefined;
 
 	/* URL is truth: initial comes from server (URL params), not localStorage */
-	const initial = props.initial ?? defaultLocale;
+	const initial = untrack(() => props.initial) ?? defaultLocale;
 	const [locale, setLocaleSignal] = createSignal(initial);
 
 	/* Cross-tab sync: BroadcastChannel for locale (opt-in) */
-	onMount(() => {
+	onSettled(() => {
 		if (!channel) return;
 
-		const unsubscribe = channel.onMessage((msg) => {
+		return channel.onMessage((msg) => {
 			if (msg.type === "locale" && typeof msg.value === "string" && cfg.locales.includes(msg.value)) {
 				setLocaleSignal(msg.value);
 			}
 		});
+	});
 
+	if (channel) {
 		createEffect(
-			on(
-				locale,
-				(l) => {
-					channel.broadcast({ type: "locale", value: l });
-				},
-				{ defer: true },
-			),
+			locale,
+			(l) => {
+				channel.broadcast({ type: "locale", value: l });
+			},
+			{ defer: true },
 		);
+	}
 
-		onCleanup(unsubscribe);
-	});
-
-	createEffect(() => {
-		const l = locale();
+	createEffect(locale, (l) => {
 		if (typeof document === "undefined") return;
 		document.documentElement.setAttribute("lang", l);
-		document.cookie = `${cookieName}=${l}; path=/; max-age=31536000; samesite=lax`;
+		document.cookie = formatLocaleCookie(l, cookieName, {
+			https: typeof location !== "undefined" && location.protocol === "https:",
+		});
 	});
 
 	const setLocale = (l: string): void => {
@@ -100,7 +89,7 @@ export function LocaleProvider(props: { children: JSX.Element; config: LocaleCon
 		setLocale,
 	};
 
-	return <LocaleCtx.Provider value={value}>{props.children}</LocaleCtx.Provider>;
+	return <LocaleCtx value={value}>{props.children}</LocaleCtx>;
 }
 
 export function useLocale(): LocaleContextValue {

package/src/locale.ts

@@ -1,3 +1,4 @@
 export { LocaleScript } from "./components/locale-script.tsx";
 export type { LocaleConfig, LocaleContextValue } from "./locale/index.tsx";
+export { formatLocaleCookie } from "./locale/cookie.ts";
 export { buildHreflangLinks, getLocaleScript, LocaleProvider, useLocale } from "./locale/index.tsx";

package/src/middleware/builtins/api-proxy.ts

@@ -12,6 +12,57 @@ interface ApiProxyConfig<TEnv = unknown> {
 	target: (ctx: { env: TEnv }) => ServiceBinding;
 }
 
+const HOP_BY_HOP = new Set([
+	"connection",
+	"host",
+	"keep-alive",
+	"proxy-authenticate",
+	"proxy-authorization",
+	"te",
+	"trailer",
+	"trailers",
+	"transfer-encoding",
+	"upgrade",
+]);
+
+function copyForwardHeaders(source: Headers): Headers {
+	const headers = new Headers();
+	const extraHop = new Set<string>();
+	const connection = source.get("connection");
+	if (connection) {
+		for (const name of connection.split(",")) {
+			const trimmed = name.trim().toLowerCase();
+			if (trimmed) extraHop.add(trimmed);
+		}
+	}
+	for (const [key, value] of source) {
+		const lower = key.toLowerCase();
+		if (HOP_BY_HOP.has(lower) || extraHop.has(lower)) continue;
+		headers.append(key, value);
+	}
+	return headers;
+}
+
+function withNosniff(response: Response): Response {
+	if (response.headers.get("X-Content-Type-Options")) return response;
+	const headers = new Headers(response.headers);
+	headers.set("X-Content-Type-Options", "nosniff");
+	return new Response(response.body, {
+		headers,
+		status: response.status,
+		statusText: response.statusText,
+	});
+}
+
+function bypassText(ctx: MiddlewareContext, body: string, status: number) {
+	return ctx.bypass(
+		new Response(body, {
+			headers: { "X-Content-Type-Options": "nosniff" },
+			status,
+		}),
+	);
+}
+
 export function apiProxy<TEnv = unknown>(config: ApiProxyConfig<TEnv>): FlareMiddleware<TEnv> {
 	return async (ctx: MiddlewareContext<TEnv>) => {
 		/* check enabled */
@@ -35,10 +86,13 @@ export function apiProxy<TEnv = unknown>(config: ApiProxyConfig<TEnv>): FlareMid
 				targetPath = pathname.slice(config.pathPrefix.length) || "/";
 			}
 
-			/* build proxied request */
+			/* build proxied request — rewrite must stay on this origin */
 			const targetUrl = new URL(targetPath, ctx.url.origin);
+			if (targetUrl.origin !== ctx.url.origin) {
+				return bypassText(ctx, "Bad Request", 400);
+			}
 			targetUrl.search = ctx.url.search;
-			const headers = new Headers(ctx.request.headers);
+			const headers = copyForwardHeaders(ctx.request.headers);
 
 			if (config.headers) {
 				const extra = config.headers({ env: ctx.env, request: ctx.request });
@@ -56,9 +110,9 @@ export function apiProxy<TEnv = unknown>(config: ApiProxyConfig<TEnv>): FlareMid
 
 			const service = config.target({ env: ctx.env });
 			const response = await service.fetch(proxyRequest);
-			return ctx.bypass(response);
+			return ctx.bypass(withNosniff(response));
 		} catch {
-			return ctx.bypass(new Response("Bad Gateway", { status: 502 }));
+			return bypassText(ctx, "Bad Gateway", 502);
 		}
 	};
 }

package/src/middleware/builtins/cdn-proxy.ts

@@ -18,6 +18,23 @@ interface CdnProxyConfig<TEnv = unknown> {
 	pathPrefix: string;
 }
 
+const NOSNIFF = { "X-Content-Type-Options": "nosniff" } as const;
+
+function isNavigableExecutable(contentType: string): boolean {
+	const mime = contentType.split(";", 1)[0]?.trim().toLowerCase() ?? "";
+	return (
+		mime === "application/xhtml+xml" ||
+		mime === "application/xml" ||
+		mime === "image/svg+xml" ||
+		mime === "text/html" ||
+		mime === "text/xml"
+	);
+}
+
+function bypassText(ctx: MiddlewareContext, body: string, status: number) {
+	return ctx.bypass(new Response(body, { headers: NOSNIFF, status }));
+}
+
 export function cdnProxy<TEnv = unknown>(config: CdnProxyConfig<TEnv>): FlareMiddleware<TEnv> {
 	const defaultCacheControl = config.cacheControl ?? "public, max-age=31536000, immutable";
 
@@ -30,27 +47,31 @@ export function cdnProxy<TEnv = unknown>(config: CdnProxyConfig<TEnv>): FlareMid
 		try {
 			key = decodeURIComponent(rawKey);
 		} catch {
-			return ctx.bypass(new Response("Bad Request", { status: 400 }));
+			return bypassText(ctx, "Bad Request", 400);
 		}
 		/* Reject path traversal, null bytes, backslashes, and CRLF */
 		if (key.includes("..") || key.includes("\0") || key.includes("\\") || key.includes("\r") || key.includes("\n")) {
-			return ctx.bypass(new Response("Bad Request", { status: 400 }));
+			return bypassText(ctx, "Bad Request", 400);
 		}
 		const bucket = config.bucket({ env: ctx.env });
 		const object = await bucket.get(key);
 
 		if (!object) {
-			return ctx.bypass(new Response("Not Found", { status: 404 }));
+			return bypassText(ctx, "Not Found", 404);
 		}
 
 		const headers: Record<string, string> = {
 			"Cache-Control": defaultCacheControl,
 			"Content-Length": String(object.size),
 			ETag: object.etag,
+			"X-Content-Type-Options": "nosniff",
 		};
 
 		if (object.httpMetadata?.contentType) {
 			headers["Content-Type"] = object.httpMetadata.contentType;
+			if (isNavigableExecutable(object.httpMetadata.contentType)) {
+				headers["Content-Disposition"] = "attachment";
+			}
 		}
 
 		return ctx.bypass(new Response(object.body, { headers }));

package/src/middleware/builtins/i18n.ts

@@ -2,6 +2,8 @@ import { match as cldrMatch } from "@formatjs/intl-localematcher";
 import { isbot } from "isbot";
 import Negotiator from "negotiator";
 import type { FlareMiddleware } from "..";
+import { formatLocaleCookie } from "../../locale/cookie.ts";
+import { HEADER_DATA, HEADER_FLAG, HEADER_PRERENDER, HEADER_PREFETCH, INTERNAL_PATH_PREFIX } from "../../protocol.ts";
 import { matchRoute, toLocaleMatch } from "../../router-primitives/tree.ts";
 
 /**
@@ -68,6 +70,13 @@ function getLocaleFromAcceptLanguage(request: Request, locales: readonly string[
 	return defaultLocale;
 }
 
+/** Path-only Location so the document applies Set-Cookie on 3xx (SW fetch() with follow does not). */
+function locationForPath(url: URL, pathname: string): string {
+	const next = new URL(url);
+	next.pathname = pathname;
+	return `${next.pathname}${next.search}${next.hash}`;
+}
+
 function buildCookieHeader(
 	locale: string,
 	cookieName: string,
@@ -75,12 +84,7 @@ function buildCookieHeader(
 	isHttps: boolean,
 	secure?: boolean,
 ): string {
-	/* Defense-in-depth: strip chars that could enable header/cookie injection.
-	 * Primary gate is localeSet.has() before any call site, but this guards
-	 * against future code paths that might bypass that check. */
-	const safe = locale.replace(/[\r\n;\0]/g, "");
-	const secureFlag = (secure ?? isHttps) ? "; Secure" : "";
-	return `${cookieName}=${safe}; Path=/; Max-Age=${maxAge}; SameSite=Lax${secureFlag}`;
+	return formatLocaleCookie(locale, cookieName, { https: isHttps, maxAge, secure });
 }
 
 export function i18n(options?: I18nMiddlewareOptions): FlareMiddleware {
@@ -102,14 +106,14 @@ export function i18n(options?: I18nMiddlewareOptions): FlareMiddleware {
 			cachedCookieName = options?.cookieName ?? ctx.locale.cookieName ?? "flare.locale";
 			cachedMaxAge = options?.cookie?.maxAge ?? 31536000;
 			const skip = options?.skip ?? ctx.locale.skip ?? [];
-			cachedSkipPaths = ["/_fn/", ...skip];
+			cachedSkipPaths = [INTERNAL_PATH_PREFIX, ...skip];
 		}
 
 		const { pathname } = ctx.url;
 		const isHttps = ctx.url.protocol === "https:";
 
 		/* Prerender snapshots the exact expanded URL — do not locale-redirect. */
-		if (ctx.request.headers.get("x-flare-prerender") === "1") {
+		if (ctx.request.headers.get(HEADER_PRERENDER) === HEADER_FLAG) {
 			const prerenderLocale = getLocaleFromPath(pathname, cachedLocaleSet);
 			ctx.serverContext.locale = prerenderLocale ?? defaultLocale;
 			return ctx.next();
@@ -146,9 +150,9 @@ export function i18n(options?: I18nMiddlewareOptions): FlareMiddleware {
 		if (firstSegment && LOCALE_LIKE_RE.test(firstSegment)) {
 			const lowerSegment = firstSegment.toLowerCase();
 			if (firstSegment !== lowerSegment) {
-				const newUrl = new URL(ctx.url);
-				newUrl.pathname = pathname.replace(firstSegment, lowerSegment);
-				const headers = new Headers({ Location: newUrl.href });
+				const headers = new Headers({
+					Location: locationForPath(ctx.url, pathname.replace(firstSegment, lowerSegment)),
+				});
 				if (cachedLocaleSet.has(lowerSegment)) {
 					headers.set(
 						"Set-Cookie",
@@ -165,9 +169,9 @@ export function i18n(options?: I18nMiddlewareOptions): FlareMiddleware {
 
 		/* Invalid/unsupported locale-like segment in path → strip it */
 		if (hasInvalidLocale) {
-			const newUrl = new URL(ctx.url);
-			newUrl.pathname = pathname.replace(`/${firstSegment}`, "") || "/";
-			const headers = new Headers({ Location: newUrl.href });
+			const headers = new Headers({
+				Location: locationForPath(ctx.url, pathname.replace(`/${firstSegment}`, "") || "/"),
+			});
 			headers.set(
 				"Set-Cookie",
 				buildCookieHeader(defaultLocale, cachedCookieName, cachedMaxAge, isHttps, options?.cookie?.secure),
@@ -182,9 +186,7 @@ export function i18n(options?: I18nMiddlewareOptions): FlareMiddleware {
 			const canStrip =
 				!ctx.routeTree || matchRoute(ctx.routeTree, strippedPath, false, toLocaleMatch(ctx.locale)) !== null;
 			if (canStrip) {
-				const newUrl = new URL(ctx.url);
-				newUrl.pathname = strippedPath;
-				const headers = new Headers({ Location: newUrl.href });
+				const headers = new Headers({ Location: locationForPath(ctx.url, strippedPath) });
 				headers.set(
 					"Set-Cookie",
 					buildCookieHeader(defaultLocale, cachedCookieName, cachedMaxAge, isHttps, options?.cookie?.secure),
@@ -200,9 +202,7 @@ export function i18n(options?: I18nMiddlewareOptions): FlareMiddleware {
 		if (!pathLocale && pathname === "/" && !cookieLocale) {
 			const acceptLocale = getLocaleFromAcceptLanguage(ctx.request, locales, defaultLocale);
 			if (acceptLocale !== defaultLocale) {
-				const newUrl = new URL(ctx.url);
-				newUrl.pathname = `/${acceptLocale}`;
-				const headers = new Headers({ Location: newUrl.href });
+				const headers = new Headers({ Location: locationForPath(ctx.url, `/${acceptLocale}`) });
 				headers.set(
 					"Set-Cookie",
 					buildCookieHeader(acceptLocale, cachedCookieName, cachedMaxAge, isHttps, options?.cookie?.secure),
@@ -216,13 +216,11 @@ export function i18n(options?: I18nMiddlewareOptions): FlareMiddleware {
 		 * Only for full page loads (not NDJSON/prefetch — SPA router handles those).
 		 * e.g. /about with cookie=fr → 302 → /fr/about
 		 */
-		const isDataRequest = ctx.request.headers.get("x-d") === "1";
+		const isDataRequest = ctx.request.headers.get(HEADER_DATA) === HEADER_FLAG;
 		if (!pathLocale && cookieLocale && cookieLocale !== defaultLocale && !isDataRequest) {
-			const newUrl = new URL(ctx.url);
-			newUrl.pathname = `/${cookieLocale}${pathname}`;
 			return ctx.bypass(
 				new Response(null, {
-					headers: new Headers({ Location: newUrl.href }),
+					headers: new Headers({ Location: locationForPath(ctx.url, `/${cookieLocale}${pathname}`) }),
 					status: 302,
 				}),
 			);
@@ -235,7 +233,7 @@ export function i18n(options?: I18nMiddlewareOptions): FlareMiddleware {
 		/* Prefetch requests must not set cookies — SPA prefetches multiple
 		 * locale URLs after hydration, and the last one to complete would
 		 * overwrite the correct cookie from the actual page load. */
-		const isPrefetch = ctx.request.headers.get("x-p") === "1";
+		const isPrefetch = ctx.request.headers.get(HEADER_PREFETCH) === HEADER_FLAG;
 		const needsCookie = !isPrefetch && currentLocale !== cookieLocale;
 		if (needsCookie) {
 			const setCookieHeader = buildCookieHeader(

package/src/middleware/builtins/keepalive.ts

@@ -1,15 +1,14 @@
 import { error } from "../../logger.ts";
+import { KEEPALIVE_PATH } from "../../protocol.ts";
 import type { FlareMiddleware, MiddlewareContext } from "..";
 
-const PING_PATH = "/_flare/keepalive";
-
 interface KeepaliveConfig<TEnv = unknown> {
 	handler?: (ctx: MiddlewareContext<TEnv>) => Promise<void> | void;
 }
 
 export function keepalive<TEnv = unknown>(config?: KeepaliveConfig<TEnv>): FlareMiddleware<TEnv> {
 	return async (ctx: MiddlewareContext<TEnv>) => {
-		if (ctx.url.pathname !== PING_PATH || ctx.request.method !== "GET") return ctx.next();
+		if (ctx.url.pathname !== KEEPALIVE_PATH || ctx.request.method !== "GET") return ctx.next();
 
 		if (config?.handler) {
 			try {

package/src/mount/index.ts

@@ -41,8 +41,15 @@ export function matchMount<TEnv>(mounts: MountConfig<TEnv>[], pathname: string):
 }
 
 export function buildMountRequest<TEnv>(request: Request, mount: MountConfig<TEnv>, url: URL): Request {
-	const strippedPath = url.pathname.slice(mount.prefix.length) || "/";
+	let strippedPath = url.pathname.slice(mount.prefix.length) || "/";
+	if (!strippedPath.startsWith("/")) strippedPath = `/${strippedPath}`;
+	if (strippedPath.startsWith("//") || strippedPath.includes("\\") || /[\0\r\n]/.test(strippedPath)) {
+		strippedPath = "/";
+	}
 	const target = new URL(strippedPath, url.origin);
+	if (target.origin !== url.origin) {
+		target.href = `${url.origin}/`;
+	}
 	target.search = url.search;
 	target.hash = url.hash;
 	return new Request(target.toString(), {