@opennextjs/aws 4.1.9 → 4.1.10

package/dist/core/routing/middleware.d.ts

@@ -4,11 +4,15 @@ type MiddlewareLoader = () => Promise<{
     default: Middleware;
 }>;
 /**
+ * Runs matching Next.js middleware and applies its routing result.
  *
- * @param internalEvent the internal event
- * @param initialSearch the initial query string as it was received in the handler
- * @param middlewareLoader Only used for unit test
- * @returns `Promise<MiddlewareEvent | InternalResult>`
+ * Middleware request-header overrides are normalized and filtered to Next.js's allowlist.
+ *
+ * @param internalEvent The internal request event.
+ * @param initialSearch The initial query string received by the handler.
+ * @param middlewareLoader The middleware loader, overridden by unit tests.
+ * @return The middleware-adjusted event or a terminal middleware response.
+ * @throws When middleware loading, execution, or response processing fails.
  */
 export declare function handleMiddleware(internalEvent: InternalEvent, initialSearch: string, middlewareLoader?: MiddlewareLoader): Promise<MiddlewareEvent | InternalResult>;
 export {};

package/dist/core/routing/middleware.js

@@ -14,11 +14,15 @@ function defaultMiddlewareLoader() {
     return import("./middleware.mjs");
 }
 /**
+ * Runs matching Next.js middleware and applies its routing result.
  *
- * @param internalEvent the internal event
- * @param initialSearch the initial query string as it was received in the handler
- * @param middlewareLoader Only used for unit test
- * @returns `Promise<MiddlewareEvent | InternalResult>`
+ * Middleware request-header overrides are normalized and filtered to Next.js's allowlist.
+ *
+ * @param internalEvent The internal request event.
+ * @param initialSearch The initial query string received by the handler.
+ * @param middlewareLoader The middleware loader, overridden by unit tests.
+ * @return The middleware-adjusted event or a terminal middleware response.
+ * @throws When middleware loading, execution, or response processing fails.
  */
 export async function handleMiddleware(internalEvent, initialSearch, middlewareLoader = defaultMiddlewareLoader) {
     const headers = internalEvent.headers;
@@ -81,11 +85,15 @@ export async function handleMiddleware(internalEvent, initialSearch, middlewareL
   
       We can delete `x-middleware-override-headers` and check if the key starts with
       x-middleware-request- to set the req headers
+  
+      The request headers that are not listed in `x-middleware-override-headers` have been
+      deleted by the middleware and must not be forwarded.
     */
     const responseHeaders = result.headers;
     const reqHeaders = {};
     const resHeaders = {};
     // These are internal headers used by Next.js, we don't want to expose them to the client
+    // NOTE: keys must be in lowercase to match the normalized header keys.
     const filteredHeaders = [
         "x-middleware-override-headers",
         "x-middleware-next",
@@ -95,21 +103,23 @@ export async function handleMiddleware(internalEvent, initialSearch, middlewareL
     ];
     const xMiddlewareKey = "x-middleware-request-";
     responseHeaders.forEach((value, key) => {
-        if (key.startsWith(xMiddlewareKey)) {
-            const k = key.substring(xMiddlewareKey.length);
+        // Always use the normalized key (lowercase) for comparison and storage.
+        const normalizedKey = key.toLowerCase();
+        if (normalizedKey.startsWith(xMiddlewareKey)) {
+            const k = normalizedKey.substring(xMiddlewareKey.length);
             reqHeaders[k] = value;
         }
         else {
-            if (filteredHeaders.includes(key.toLowerCase()))
+            if (filteredHeaders.includes(normalizedKey))
                 return;
             // Headers.forEach folds same-name headers; use getSetCookie() below instead.
-            if (key.toLowerCase() === "set-cookie")
+            if (normalizedKey === "set-cookie")
                 return;
-            if (REDIRECTS.has(statusCode) && key.toLowerCase() === "location") {
-                resHeaders[key] = normalizeLocationHeader(value, internalEvent.url);
+            if (REDIRECTS.has(statusCode) && normalizedKey === "location") {
+                resHeaders[normalizedKey] = normalizeLocationHeader(value, internalEvent.url);
             }
             else {
-                resHeaders[key] = value;
+                resHeaders[normalizedKey] = value;
             }
         }
     });
@@ -122,6 +132,13 @@ export async function handleMiddleware(internalEvent, initialSearch, middlewareL
     if (setCookies.length > 0) {
         resHeaders["set-cookie"] = setCookies;
     }
+    const overrideHeaders = responseHeaders.get("x-middleware-override-headers");
+    const overriddenHeaders = overrideHeaders === null
+        ? undefined
+        : new Set(overrideHeaders.split(",").map((key) => key.trim().toLowerCase()));
+    const newHeaders = Object.fromEntries([...Object.entries(internalEvent.headers), ...Object.entries(reqHeaders)]
+        .map(([key, value]) => [key.toLowerCase(), value])
+        .filter(([key]) => !overriddenHeaders || overriddenHeaders.has(key)));
     // If the middleware returned a Rewrite, set the `url` to the pathname of the rewrite
     // NOTE: the header was added to `req` from above
     const rewriteUrl = responseHeaders.get("x-middleware-rewrite");
@@ -162,7 +179,7 @@ export async function handleMiddleware(internalEvent, initialSearch, middlewareL
         url: newUrl,
         rawPath: new URL(newUrl).pathname,
         type: internalEvent.type,
-        headers: { ...internalEvent.headers, ...reqHeaders },
+        headers: newHeaders,
         body: internalEvent.body,
         method: internalEvent.method,
         query: middlewareQuery,

package/package.json

@@ -3,7 +3,7 @@
     "access": "public"
   },
   "name": "@opennextjs/aws",
-  "version": "4.1.9",
+  "version": "4.1.10",
   "bin": {
     "open-next": "./dist/index.js"
   },