@preprio/toolkit 0.2.0-beta.5 → 0.2.0-beta.6

package/dist/astro/index.cjs

@@ -30,7 +30,7 @@ __export(astro_exports, {
 module.exports = __toCommonJS(astro_exports);
 
 // src/version.ts
-var VERSION = "0.2.0-beta.5";
+var VERSION = "0.2.0-beta.6";
 
 // src/core/features.ts
 function isEnabled(config) {
@@ -193,6 +193,11 @@ var UTM_PARAMS = [
   "utm_content",
   "utm_campaign"
 ];
+var MAX_HEADER_VALUE_LENGTH = 2048;
+function sanitizeHeaderValue(value) {
+  const stripped = value.replace(/[\u0000-\u001f\u007f]/g, "");
+  return stripped.length > MAX_HEADER_VALUE_LENGTH ? stripped.slice(0, MAX_HEADER_VALUE_LENGTH) : stripped;
+}
 function serializeCookie(cookie) {
   const parts = [
     `${cookie.name}=${encodeURIComponent(cookie.value)}`,
@@ -224,6 +229,15 @@ function parseCookies(request) {
 function processPreprRequest(request, opts) {
   const requestHeaders = new Headers(request.headers);
   const responseCookies = [];
+  const inboundPreprHeaders = [];
+  requestHeaders.forEach((_value, key) => {
+    if (key.toLowerCase().startsWith("prepr-")) {
+      inboundPreprHeaders.push(key);
+    }
+  });
+  for (const key of inboundPreprHeaders) {
+    requestHeaders.delete(key);
+  }
   const requestCookies = parseCookies(request);
   const url = new URL(request.url);
   const searchParams = url.searchParams;
@@ -233,25 +247,28 @@ function processPreprRequest(request, opts) {
   for (const key of UTM_PARAMS) {
     const value = searchParams.get(key);
     if (value !== null) {
-      requestHeaders.set(`Prepr-Context-${key}`, value);
+      requestHeaders.set(`Prepr-Context-${key}`, sanitizeHeaderValue(value));
     }
   }
   const referer = request.headers.get("referer");
   if (referer) {
-    requestHeaders.set("Prepr-Context-initial_referral", referer);
+    requestHeaders.set(
+      "Prepr-Context-initial_referral",
+      sanitizeHeaderValue(referer)
+    );
   }
   const userAgent = request.headers.get("user-agent");
   if (userAgent) {
-    requestHeaders.set("Prepr-User-Agent", userAgent);
+    requestHeaders.set("Prepr-User-Agent", sanitizeHeaderValue(userAgent));
   }
   requestHeaders.set("Prepr-Package", `@preprio/toolkit@${opts?.version ?? VERSION}`);
   const ip = request.headers.get("Cf-Connecting-Ip") ?? request.headers.get("x-real-ip");
   if (ip) {
-    requestHeaders.set("Prepr-Visitor-IP", ip);
+    requestHeaders.set("Prepr-Visitor-IP", sanitizeHeaderValue(ip));
   }
   const hutkCookie = requestCookies.get(COOKIE_HUBSPOT);
   if (hutkCookie) {
-    requestHeaders.set("Prepr-Hubspot-Id", hutkCookie);
+    requestHeaders.set("Prepr-Hubspot-Id", sanitizeHeaderValue(hutkCookie));
   }
   let uid = requestCookies.get(COOKIE_UID);
   if (!uid) {
@@ -291,16 +308,16 @@ function processPreprRequest(request, opts) {
   if (!isLivePreview) {
     const segmentCookie = features.segments ? requestCookies.get(COOKIE_SEGMENT) : void 0;
     if (segmentCookie) {
-      requestHeaders.set("Prepr-Segments", segmentCookie);
+      requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(segmentCookie));
     }
     const abCookie = features.abTesting ? requestCookies.get(COOKIE_VARIANT) : void 0;
     if (abCookie) {
-      requestHeaders.set("Prepr-ABtesting", abCookie);
+      requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(abCookie));
     }
   }
   const previewAb = features.abTesting ? searchParams.get(PARAM_VARIANT) : null;
   if (previewAb !== null) {
-    requestHeaders.set("Prepr-ABtesting", previewAb);
+    requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(previewAb));
     if (!isLivePreview) {
       responseCookies.push({
         name: COOKIE_VARIANT,
@@ -313,7 +330,7 @@ function processPreprRequest(request, opts) {
   }
   const previewSegment = features.segments ? searchParams.get(PARAM_SEGMENT) : null;
   if (previewSegment !== null) {
-    requestHeaders.set("Prepr-Segments", previewSegment);
+    requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(previewSegment));
     if (!isLivePreview) {
       responseCookies.push({
         name: COOKIE_SEGMENT,

package/dist/astro/index.js

@@ -1,5 +1,5 @@
 // src/version.ts
-var VERSION = "0.2.0-beta.5";
+var VERSION = "0.2.0-beta.6";
 
 // src/core/features.ts
 function isEnabled(config) {
@@ -162,6 +162,11 @@ var UTM_PARAMS = [
   "utm_content",
   "utm_campaign"
 ];
+var MAX_HEADER_VALUE_LENGTH = 2048;
+function sanitizeHeaderValue(value) {
+  const stripped = value.replace(/[\u0000-\u001f\u007f]/g, "");
+  return stripped.length > MAX_HEADER_VALUE_LENGTH ? stripped.slice(0, MAX_HEADER_VALUE_LENGTH) : stripped;
+}
 function serializeCookie(cookie) {
   const parts = [
     `${cookie.name}=${encodeURIComponent(cookie.value)}`,
@@ -193,6 +198,15 @@ function parseCookies(request) {
 function processPreprRequest(request, opts) {
   const requestHeaders = new Headers(request.headers);
   const responseCookies = [];
+  const inboundPreprHeaders = [];
+  requestHeaders.forEach((_value, key) => {
+    if (key.toLowerCase().startsWith("prepr-")) {
+      inboundPreprHeaders.push(key);
+    }
+  });
+  for (const key of inboundPreprHeaders) {
+    requestHeaders.delete(key);
+  }
   const requestCookies = parseCookies(request);
   const url = new URL(request.url);
   const searchParams = url.searchParams;
@@ -202,25 +216,28 @@ function processPreprRequest(request, opts) {
   for (const key of UTM_PARAMS) {
     const value = searchParams.get(key);
     if (value !== null) {
-      requestHeaders.set(`Prepr-Context-${key}`, value);
+      requestHeaders.set(`Prepr-Context-${key}`, sanitizeHeaderValue(value));
     }
   }
   const referer = request.headers.get("referer");
   if (referer) {
-    requestHeaders.set("Prepr-Context-initial_referral", referer);
+    requestHeaders.set(
+      "Prepr-Context-initial_referral",
+      sanitizeHeaderValue(referer)
+    );
   }
   const userAgent = request.headers.get("user-agent");
   if (userAgent) {
-    requestHeaders.set("Prepr-User-Agent", userAgent);
+    requestHeaders.set("Prepr-User-Agent", sanitizeHeaderValue(userAgent));
   }
   requestHeaders.set("Prepr-Package", `@preprio/toolkit@${opts?.version ?? VERSION}`);
   const ip = request.headers.get("Cf-Connecting-Ip") ?? request.headers.get("x-real-ip");
   if (ip) {
-    requestHeaders.set("Prepr-Visitor-IP", ip);
+    requestHeaders.set("Prepr-Visitor-IP", sanitizeHeaderValue(ip));
   }
   const hutkCookie = requestCookies.get(COOKIE_HUBSPOT);
   if (hutkCookie) {
-    requestHeaders.set("Prepr-Hubspot-Id", hutkCookie);
+    requestHeaders.set("Prepr-Hubspot-Id", sanitizeHeaderValue(hutkCookie));
   }
   let uid = requestCookies.get(COOKIE_UID);
   if (!uid) {
@@ -260,16 +277,16 @@ function processPreprRequest(request, opts) {
   if (!isLivePreview) {
     const segmentCookie = features.segments ? requestCookies.get(COOKIE_SEGMENT) : void 0;
     if (segmentCookie) {
-      requestHeaders.set("Prepr-Segments", segmentCookie);
+      requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(segmentCookie));
     }
     const abCookie = features.abTesting ? requestCookies.get(COOKIE_VARIANT) : void 0;
     if (abCookie) {
-      requestHeaders.set("Prepr-ABtesting", abCookie);
+      requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(abCookie));
     }
   }
   const previewAb = features.abTesting ? searchParams.get(PARAM_VARIANT) : null;
   if (previewAb !== null) {
-    requestHeaders.set("Prepr-ABtesting", previewAb);
+    requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(previewAb));
     if (!isLivePreview) {
       responseCookies.push({
         name: COOKIE_VARIANT,
@@ -282,7 +299,7 @@ function processPreprRequest(request, opts) {
   }
   const previewSegment = features.segments ? searchParams.get(PARAM_SEGMENT) : null;
   if (previewSegment !== null) {
-    requestHeaders.set("Prepr-Segments", previewSegment);
+    requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(previewSegment));
     if (!isLivePreview) {
       responseCookies.push({
         name: COOKIE_SEGMENT,

package/dist/{chunk-BYJ2JBGX.js → chunk-C6YEXA5G.js}

@@ -1909,7 +1909,10 @@ function createIframeBridge(store, options = {}) {
   };
   return {
     start() {
-      sendPreprEvent("loaded", void 0, { allowUntrustedTarget: true });
+      const features = store?.get().features;
+      sendPreprEvent("loaded", features ? { features } : void 0, {
+        allowUntrustedTarget: true
+      });
       window.addEventListener("keydown", onKeyDown);
       window.addEventListener("message", onMessage);
     },
@@ -2026,6 +2029,14 @@ function defaultNavigation() {
     currentPath: () => window.location.pathname + window.location.search
   };
 }
+function safeEditUrl(href) {
+  try {
+    const url = new URL(href, window.location.href);
+    return url.protocol === "https:" || url.protocol === "http:" ? url.href : null;
+  } catch {
+    return null;
+  }
+}
 function buildSegments(data) {
   return [{ _id: "all_other_users", name: "All other users" }, ...data];
 }
@@ -2089,10 +2100,20 @@ function createPreprPreview(opts = {}) {
     // In the editor, ask the parent to focus the field instead of opening a new
     // tab. Standalone previews keep the window.open behaviour.
     onEdit: ({ href, origin, id, field }) => {
+      const safeHref = href ? safeEditUrl(href) : null;
+      if (href && !safeHref) {
+        debug7.warn("ignored edit request with unsupported href scheme");
+        return;
+      }
       if (isIframe) {
-        sendPreprEvent("field_edit_requested", { href, origin, id, field });
-      } else if (href) {
-        window.open(href);
+        sendPreprEvent("field_edit_requested", {
+          href: safeHref ?? void 0,
+          origin,
+          id,
+          field
+        });
+      } else if (safeHref) {
+        window.open(safeHref, "_blank", "noopener,noreferrer");
       }
     }
   });

package/dist/index.cjs

@@ -44,7 +44,7 @@ __export(src_exports, {
 module.exports = __toCommonJS(src_exports);
 
 // src/version.ts
-var VERSION = "0.2.0-beta.5";
+var VERSION = "0.2.0-beta.6";
 
 // src/core/features.ts
 function isEnabled(config) {
@@ -355,7 +355,10 @@ function createIframeBridge(store, options = {}) {
   };
   return {
     start() {
-      sendPreprEvent("loaded", void 0, { allowUntrustedTarget: true });
+      const features = store?.get().features;
+      sendPreprEvent("loaded", features ? { features } : void 0, {
+        allowUntrustedTarget: true
+      });
       window.addEventListener("keydown", onKeyDown);
       window.addEventListener("message", onMessage);
     },
@@ -2074,6 +2077,14 @@ function defaultNavigation() {
     currentPath: () => window.location.pathname + window.location.search
   };
 }
+function safeEditUrl(href) {
+  try {
+    const url = new URL(href, window.location.href);
+    return url.protocol === "https:" || url.protocol === "http:" ? url.href : null;
+  } catch {
+    return null;
+  }
+}
 function buildSegments(data) {
   return [{ _id: "all_other_users", name: "All other users" }, ...data];
 }
@@ -2137,10 +2148,20 @@ function createPreprPreview(opts = {}) {
     // In the editor, ask the parent to focus the field instead of opening a new
     // tab. Standalone previews keep the window.open behaviour.
     onEdit: ({ href, origin, id, field }) => {
+      const safeHref = href ? safeEditUrl(href) : null;
+      if (href && !safeHref) {
+        debug7.warn("ignored edit request with unsupported href scheme");
+        return;
+      }
       if (isIframe) {
-        sendPreprEvent("field_edit_requested", { href, origin, id, field });
-      } else if (href) {
-        window.open(href);
+        sendPreprEvent("field_edit_requested", {
+          href: safeHref ?? void 0,
+          origin,
+          id,
+          field
+        });
+      } else if (safeHref) {
+        window.open(safeHref, "_blank", "noopener,noreferrer");
       }
     }
   });
@@ -2358,6 +2379,11 @@ var UTM_PARAMS = [
   "utm_content",
   "utm_campaign"
 ];
+var MAX_HEADER_VALUE_LENGTH = 2048;
+function sanitizeHeaderValue(value) {
+  const stripped = value.replace(/[\u0000-\u001f\u007f]/g, "");
+  return stripped.length > MAX_HEADER_VALUE_LENGTH ? stripped.slice(0, MAX_HEADER_VALUE_LENGTH) : stripped;
+}
 function parseCookies(request) {
   const cookies = /* @__PURE__ */ new Map();
   const header = request.headers.get("cookie");
@@ -2375,6 +2401,15 @@ function parseCookies(request) {
 function processPreprRequest(request, opts) {
   const requestHeaders = new Headers(request.headers);
   const responseCookies = [];
+  const inboundPreprHeaders = [];
+  requestHeaders.forEach((_value, key) => {
+    if (key.toLowerCase().startsWith("prepr-")) {
+      inboundPreprHeaders.push(key);
+    }
+  });
+  for (const key of inboundPreprHeaders) {
+    requestHeaders.delete(key);
+  }
   const requestCookies = parseCookies(request);
   const url = new URL(request.url);
   const searchParams = url.searchParams;
@@ -2384,25 +2419,28 @@ function processPreprRequest(request, opts) {
   for (const key of UTM_PARAMS) {
     const value = searchParams.get(key);
     if (value !== null) {
-      requestHeaders.set(`Prepr-Context-${key}`, value);
+      requestHeaders.set(`Prepr-Context-${key}`, sanitizeHeaderValue(value));
     }
   }
   const referer = request.headers.get("referer");
   if (referer) {
-    requestHeaders.set("Prepr-Context-initial_referral", referer);
+    requestHeaders.set(
+      "Prepr-Context-initial_referral",
+      sanitizeHeaderValue(referer)
+    );
   }
   const userAgent = request.headers.get("user-agent");
   if (userAgent) {
-    requestHeaders.set("Prepr-User-Agent", userAgent);
+    requestHeaders.set("Prepr-User-Agent", sanitizeHeaderValue(userAgent));
   }
   requestHeaders.set("Prepr-Package", `@preprio/toolkit@${opts?.version ?? VERSION}`);
   const ip = request.headers.get("Cf-Connecting-Ip") ?? request.headers.get("x-real-ip");
   if (ip) {
-    requestHeaders.set("Prepr-Visitor-IP", ip);
+    requestHeaders.set("Prepr-Visitor-IP", sanitizeHeaderValue(ip));
   }
   const hutkCookie = requestCookies.get(COOKIE_HUBSPOT);
   if (hutkCookie) {
-    requestHeaders.set("Prepr-Hubspot-Id", hutkCookie);
+    requestHeaders.set("Prepr-Hubspot-Id", sanitizeHeaderValue(hutkCookie));
   }
   let uid = requestCookies.get(COOKIE_UID);
   if (!uid) {
@@ -2442,16 +2480,16 @@ function processPreprRequest(request, opts) {
   if (!isLivePreview) {
     const segmentCookie = features.segments ? requestCookies.get(COOKIE_SEGMENT) : void 0;
     if (segmentCookie) {
-      requestHeaders.set("Prepr-Segments", segmentCookie);
+      requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(segmentCookie));
     }
     const abCookie = features.abTesting ? requestCookies.get(COOKIE_VARIANT) : void 0;
     if (abCookie) {
-      requestHeaders.set("Prepr-ABtesting", abCookie);
+      requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(abCookie));
     }
   }
   const previewAb = features.abTesting ? searchParams.get(PARAM_VARIANT) : null;
   if (previewAb !== null) {
-    requestHeaders.set("Prepr-ABtesting", previewAb);
+    requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(previewAb));
     if (!isLivePreview) {
       responseCookies.push({
         name: COOKIE_VARIANT,
@@ -2464,7 +2502,7 @@ function processPreprRequest(request, opts) {
   }
   const previewSegment = features.segments ? searchParams.get(PARAM_SEGMENT) : null;
   if (previewSegment !== null) {
-    requestHeaders.set("Prepr-Segments", previewSegment);
+    requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(previewSegment));
     if (!isLivePreview) {
       responseCookies.push({
         name: COOKIE_SEGMENT,

package/dist/index.d.cts

@@ -5,7 +5,7 @@ export { g as PreprEnvironment, h as PreprEventType, i as PreprFeatureConfig, j
  * Package version; must match package.json. Lives in its own leaf module so
  * core can import it without cycling through the barrel.
  */
-declare const VERSION = "0.2.0-beta.5";
+declare const VERSION = "0.2.0-beta.6";
 
 /**
  * Resolve a `PreprFeatures` bag to plain booleans, defaulting every omitted key

package/dist/index.d.ts

@@ -5,7 +5,7 @@ export { g as PreprEnvironment, h as PreprEventType, i as PreprFeatureConfig, j
  * Package version; must match package.json. Lives in its own leaf module so
  * core can import it without cycling through the barrel.
  */
-declare const VERSION = "0.2.0-beta.5";
+declare const VERSION = "0.2.0-beta.6";
 
 /**
  * Resolve a `PreprFeatures` bag to plain booleans, defaulting every omitted key

package/dist/index.js

@@ -17,10 +17,10 @@ import {
   setTrackingParam,
   stegaClean,
   trackEvent
-} from "./chunk-BYJ2JBGX.js";
+} from "./chunk-C6YEXA5G.js";
 
 // src/version.ts
-var VERSION = "0.2.0-beta.5";
+var VERSION = "0.2.0-beta.6";
 
 // src/core/server.ts
 var PreprError = class extends Error {
@@ -184,6 +184,11 @@ var UTM_PARAMS = [
   "utm_content",
   "utm_campaign"
 ];
+var MAX_HEADER_VALUE_LENGTH = 2048;
+function sanitizeHeaderValue(value) {
+  const stripped = value.replace(/[\u0000-\u001f\u007f]/g, "");
+  return stripped.length > MAX_HEADER_VALUE_LENGTH ? stripped.slice(0, MAX_HEADER_VALUE_LENGTH) : stripped;
+}
 function parseCookies(request) {
   const cookies = /* @__PURE__ */ new Map();
   const header = request.headers.get("cookie");
@@ -201,6 +206,15 @@ function parseCookies(request) {
 function processPreprRequest(request, opts) {
   const requestHeaders = new Headers(request.headers);
   const responseCookies = [];
+  const inboundPreprHeaders = [];
+  requestHeaders.forEach((_value, key) => {
+    if (key.toLowerCase().startsWith("prepr-")) {
+      inboundPreprHeaders.push(key);
+    }
+  });
+  for (const key of inboundPreprHeaders) {
+    requestHeaders.delete(key);
+  }
   const requestCookies = parseCookies(request);
   const url = new URL(request.url);
   const searchParams = url.searchParams;
@@ -210,25 +224,28 @@ function processPreprRequest(request, opts) {
   for (const key of UTM_PARAMS) {
     const value = searchParams.get(key);
     if (value !== null) {
-      requestHeaders.set(`Prepr-Context-${key}`, value);
+      requestHeaders.set(`Prepr-Context-${key}`, sanitizeHeaderValue(value));
     }
   }
   const referer = request.headers.get("referer");
   if (referer) {
-    requestHeaders.set("Prepr-Context-initial_referral", referer);
+    requestHeaders.set(
+      "Prepr-Context-initial_referral",
+      sanitizeHeaderValue(referer)
+    );
   }
   const userAgent = request.headers.get("user-agent");
   if (userAgent) {
-    requestHeaders.set("Prepr-User-Agent", userAgent);
+    requestHeaders.set("Prepr-User-Agent", sanitizeHeaderValue(userAgent));
   }
   requestHeaders.set("Prepr-Package", `@preprio/toolkit@${opts?.version ?? VERSION}`);
   const ip = request.headers.get("Cf-Connecting-Ip") ?? request.headers.get("x-real-ip");
   if (ip) {
-    requestHeaders.set("Prepr-Visitor-IP", ip);
+    requestHeaders.set("Prepr-Visitor-IP", sanitizeHeaderValue(ip));
   }
   const hutkCookie = requestCookies.get(COOKIE_HUBSPOT);
   if (hutkCookie) {
-    requestHeaders.set("Prepr-Hubspot-Id", hutkCookie);
+    requestHeaders.set("Prepr-Hubspot-Id", sanitizeHeaderValue(hutkCookie));
   }
   let uid = requestCookies.get(COOKIE_UID);
   if (!uid) {
@@ -268,16 +285,16 @@ function processPreprRequest(request, opts) {
   if (!isLivePreview) {
     const segmentCookie = features.segments ? requestCookies.get(COOKIE_SEGMENT) : void 0;
     if (segmentCookie) {
-      requestHeaders.set("Prepr-Segments", segmentCookie);
+      requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(segmentCookie));
     }
     const abCookie = features.abTesting ? requestCookies.get(COOKIE_VARIANT) : void 0;
     if (abCookie) {
-      requestHeaders.set("Prepr-ABtesting", abCookie);
+      requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(abCookie));
     }
   }
   const previewAb = features.abTesting ? searchParams.get(PARAM_VARIANT) : null;
   if (previewAb !== null) {
-    requestHeaders.set("Prepr-ABtesting", previewAb);
+    requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(previewAb));
     if (!isLivePreview) {
       responseCookies.push({
         name: COOKIE_VARIANT,
@@ -290,7 +307,7 @@ function processPreprRequest(request, opts) {
   }
   const previewSegment = features.segments ? searchParams.get(PARAM_SEGMENT) : null;
   if (previewSegment !== null) {
-    requestHeaders.set("Prepr-Segments", previewSegment);
+    requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(previewSegment));
     if (!isLivePreview) {
       responseCookies.push({
         name: COOKIE_SEGMENT,

package/dist/nextjs/components.cjs

@@ -335,7 +335,10 @@ function createIframeBridge(store, options = {}) {
   };
   return {
     start() {
-      sendPreprEvent("loaded", void 0, { allowUntrustedTarget: true });
+      const features = store?.get().features;
+      sendPreprEvent("loaded", features ? { features } : void 0, {
+        allowUntrustedTarget: true
+      });
       window.addEventListener("keydown", onKeyDown);
       window.addEventListener("message", onMessage);
     },
@@ -2050,6 +2053,14 @@ function defaultNavigation() {
     currentPath: () => window.location.pathname + window.location.search
   };
 }
+function safeEditUrl(href) {
+  try {
+    const url = new URL(href, window.location.href);
+    return url.protocol === "https:" || url.protocol === "http:" ? url.href : null;
+  } catch {
+    return null;
+  }
+}
 function buildSegments(data) {
   return [{ _id: "all_other_users", name: "All other users" }, ...data];
 }
@@ -2113,10 +2124,20 @@ function createPreprPreview(opts = {}) {
     // In the editor, ask the parent to focus the field instead of opening a new
     // tab. Standalone previews keep the window.open behaviour.
     onEdit: ({ href, origin, id, field }) => {
+      const safeHref = href ? safeEditUrl(href) : null;
+      if (href && !safeHref) {
+        debug7.warn("ignored edit request with unsupported href scheme");
+        return;
+      }
       if (isIframe) {
-        sendPreprEvent("field_edit_requested", { href, origin, id, field });
-      } else if (href) {
-        window.open(href);
+        sendPreprEvent("field_edit_requested", {
+          href: safeHref ?? void 0,
+          origin,
+          id,
+          field
+        });
+      } else if (safeHref) {
+        window.open(safeHref, "_blank", "noopener,noreferrer");
       }
     }
   });

package/dist/nextjs/components.js

@@ -2,7 +2,7 @@
 import {
   createPreprPreview,
   loadTrackingPixel
-} from "../chunk-BYJ2JBGX.js";
+} from "../chunk-C6YEXA5G.js";
 
 // src/nextjs/components.ts
 import { usePathname, useRouter } from "next/navigation";

package/dist/nextjs/index.cjs

@@ -38,7 +38,7 @@ module.exports = __toCommonJS(nextjs_exports);
 var import_server = require("next/server");
 
 // src/version.ts
-var VERSION = "0.2.0-beta.5";
+var VERSION = "0.2.0-beta.6";
 
 // src/core/constants.ts
 var COOKIE_PREVIEW_MODE = "Prepr-Preview-Mode";
@@ -77,6 +77,11 @@ var UTM_PARAMS = [
   "utm_content",
   "utm_campaign"
 ];
+var MAX_HEADER_VALUE_LENGTH = 2048;
+function sanitizeHeaderValue(value) {
+  const stripped = value.replace(/[\u0000-\u001f\u007f]/g, "");
+  return stripped.length > MAX_HEADER_VALUE_LENGTH ? stripped.slice(0, MAX_HEADER_VALUE_LENGTH) : stripped;
+}
 function parseCookies(request) {
   const cookies = /* @__PURE__ */ new Map();
   const header = request.headers.get("cookie");
@@ -94,6 +99,15 @@ function parseCookies(request) {
 function processPreprRequest(request, opts) {
   const requestHeaders = new Headers(request.headers);
   const responseCookies = [];
+  const inboundPreprHeaders = [];
+  requestHeaders.forEach((_value, key) => {
+    if (key.toLowerCase().startsWith("prepr-")) {
+      inboundPreprHeaders.push(key);
+    }
+  });
+  for (const key of inboundPreprHeaders) {
+    requestHeaders.delete(key);
+  }
   const requestCookies = parseCookies(request);
   const url = new URL(request.url);
   const searchParams = url.searchParams;
@@ -103,25 +117,28 @@ function processPreprRequest(request, opts) {
   for (const key of UTM_PARAMS) {
     const value = searchParams.get(key);
     if (value !== null) {
-      requestHeaders.set(`Prepr-Context-${key}`, value);
+      requestHeaders.set(`Prepr-Context-${key}`, sanitizeHeaderValue(value));
     }
   }
   const referer = request.headers.get("referer");
   if (referer) {
-    requestHeaders.set("Prepr-Context-initial_referral", referer);
+    requestHeaders.set(
+      "Prepr-Context-initial_referral",
+      sanitizeHeaderValue(referer)
+    );
   }
   const userAgent = request.headers.get("user-agent");
   if (userAgent) {
-    requestHeaders.set("Prepr-User-Agent", userAgent);
+    requestHeaders.set("Prepr-User-Agent", sanitizeHeaderValue(userAgent));
   }
   requestHeaders.set("Prepr-Package", `@preprio/toolkit@${opts?.version ?? VERSION}`);
   const ip = request.headers.get("Cf-Connecting-Ip") ?? request.headers.get("x-real-ip");
   if (ip) {
-    requestHeaders.set("Prepr-Visitor-IP", ip);
+    requestHeaders.set("Prepr-Visitor-IP", sanitizeHeaderValue(ip));
   }
   const hutkCookie = requestCookies.get(COOKIE_HUBSPOT);
   if (hutkCookie) {
-    requestHeaders.set("Prepr-Hubspot-Id", hutkCookie);
+    requestHeaders.set("Prepr-Hubspot-Id", sanitizeHeaderValue(hutkCookie));
   }
   let uid = requestCookies.get(COOKIE_UID);
   if (!uid) {
@@ -161,16 +178,16 @@ function processPreprRequest(request, opts) {
   if (!isLivePreview) {
     const segmentCookie = features.segments ? requestCookies.get(COOKIE_SEGMENT) : void 0;
     if (segmentCookie) {
-      requestHeaders.set("Prepr-Segments", segmentCookie);
+      requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(segmentCookie));
     }
     const abCookie = features.abTesting ? requestCookies.get(COOKIE_VARIANT) : void 0;
     if (abCookie) {
-      requestHeaders.set("Prepr-ABtesting", abCookie);
+      requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(abCookie));
     }
   }
   const previewAb = features.abTesting ? searchParams.get(PARAM_VARIANT) : null;
   if (previewAb !== null) {
-    requestHeaders.set("Prepr-ABtesting", previewAb);
+    requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(previewAb));
     if (!isLivePreview) {
       responseCookies.push({
         name: COOKIE_VARIANT,
@@ -183,7 +200,7 @@ function processPreprRequest(request, opts) {
   }
   const previewSegment = features.segments ? searchParams.get(PARAM_SEGMENT) : null;
   if (previewSegment !== null) {
-    requestHeaders.set("Prepr-Segments", previewSegment);
+    requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(previewSegment));
     if (!isLivePreview) {
       responseCookies.push({
         name: COOKIE_SEGMENT,

package/dist/nextjs/index.js

@@ -2,7 +2,7 @@
 import { NextResponse } from "next/server";
 
 // src/version.ts
-var VERSION = "0.2.0-beta.5";
+var VERSION = "0.2.0-beta.6";
 
 // src/core/constants.ts
 var COOKIE_PREVIEW_MODE = "Prepr-Preview-Mode";
@@ -41,6 +41,11 @@ var UTM_PARAMS = [
   "utm_content",
   "utm_campaign"
 ];
+var MAX_HEADER_VALUE_LENGTH = 2048;
+function sanitizeHeaderValue(value) {
+  const stripped = value.replace(/[\u0000-\u001f\u007f]/g, "");
+  return stripped.length > MAX_HEADER_VALUE_LENGTH ? stripped.slice(0, MAX_HEADER_VALUE_LENGTH) : stripped;
+}
 function parseCookies(request) {
   const cookies = /* @__PURE__ */ new Map();
   const header = request.headers.get("cookie");
@@ -58,6 +63,15 @@ function parseCookies(request) {
 function processPreprRequest(request, opts) {
   const requestHeaders = new Headers(request.headers);
   const responseCookies = [];
+  const inboundPreprHeaders = [];
+  requestHeaders.forEach((_value, key) => {
+    if (key.toLowerCase().startsWith("prepr-")) {
+      inboundPreprHeaders.push(key);
+    }
+  });
+  for (const key of inboundPreprHeaders) {
+    requestHeaders.delete(key);
+  }
   const requestCookies = parseCookies(request);
   const url = new URL(request.url);
   const searchParams = url.searchParams;
@@ -67,25 +81,28 @@ function processPreprRequest(request, opts) {
   for (const key of UTM_PARAMS) {
     const value = searchParams.get(key);
     if (value !== null) {
-      requestHeaders.set(`Prepr-Context-${key}`, value);
+      requestHeaders.set(`Prepr-Context-${key}`, sanitizeHeaderValue(value));
     }
   }
   const referer = request.headers.get("referer");
   if (referer) {
-    requestHeaders.set("Prepr-Context-initial_referral", referer);
+    requestHeaders.set(
+      "Prepr-Context-initial_referral",
+      sanitizeHeaderValue(referer)
+    );
   }
   const userAgent = request.headers.get("user-agent");
   if (userAgent) {
-    requestHeaders.set("Prepr-User-Agent", userAgent);
+    requestHeaders.set("Prepr-User-Agent", sanitizeHeaderValue(userAgent));
   }
   requestHeaders.set("Prepr-Package", `@preprio/toolkit@${opts?.version ?? VERSION}`);
   const ip = request.headers.get("Cf-Connecting-Ip") ?? request.headers.get("x-real-ip");
   if (ip) {
-    requestHeaders.set("Prepr-Visitor-IP", ip);
+    requestHeaders.set("Prepr-Visitor-IP", sanitizeHeaderValue(ip));
   }
   const hutkCookie = requestCookies.get(COOKIE_HUBSPOT);
   if (hutkCookie) {
-    requestHeaders.set("Prepr-Hubspot-Id", hutkCookie);
+    requestHeaders.set("Prepr-Hubspot-Id", sanitizeHeaderValue(hutkCookie));
   }
   let uid = requestCookies.get(COOKIE_UID);
   if (!uid) {
@@ -125,16 +142,16 @@ function processPreprRequest(request, opts) {
   if (!isLivePreview) {
     const segmentCookie = features.segments ? requestCookies.get(COOKIE_SEGMENT) : void 0;
     if (segmentCookie) {
-      requestHeaders.set("Prepr-Segments", segmentCookie);
+      requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(segmentCookie));
     }
     const abCookie = features.abTesting ? requestCookies.get(COOKIE_VARIANT) : void 0;
     if (abCookie) {
-      requestHeaders.set("Prepr-ABtesting", abCookie);
+      requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(abCookie));
     }
   }
   const previewAb = features.abTesting ? searchParams.get(PARAM_VARIANT) : null;
   if (previewAb !== null) {
-    requestHeaders.set("Prepr-ABtesting", previewAb);
+    requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(previewAb));
     if (!isLivePreview) {
       responseCookies.push({
         name: COOKIE_VARIANT,
@@ -147,7 +164,7 @@ function processPreprRequest(request, opts) {
   }
   const previewSegment = features.segments ? searchParams.get(PARAM_SEGMENT) : null;
   if (previewSegment !== null) {
-    requestHeaders.set("Prepr-Segments", previewSegment);
+    requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(previewSegment));
     if (!isLivePreview) {
       responseCookies.push({
         name: COOKIE_SEGMENT,

package/dist/nuxt/index.cjs

@@ -35,7 +35,7 @@ __export(nuxt_exports, {
 module.exports = __toCommonJS(nuxt_exports);
 
 // src/version.ts
-var VERSION = "0.2.0-beta.5";
+var VERSION = "0.2.0-beta.6";
 
 // src/core/constants.ts
 var COOKIE_PREVIEW_MODE = "Prepr-Preview-Mode";
@@ -74,6 +74,11 @@ var UTM_PARAMS = [
   "utm_content",
   "utm_campaign"
 ];
+var MAX_HEADER_VALUE_LENGTH = 2048;
+function sanitizeHeaderValue(value) {
+  const stripped = value.replace(/[\u0000-\u001f\u007f]/g, "");
+  return stripped.length > MAX_HEADER_VALUE_LENGTH ? stripped.slice(0, MAX_HEADER_VALUE_LENGTH) : stripped;
+}
 function serializeCookie(cookie) {
   const parts = [
     `${cookie.name}=${encodeURIComponent(cookie.value)}`,
@@ -105,6 +110,15 @@ function parseCookies(request) {
 function processPreprRequest(request, opts) {
   const requestHeaders = new Headers(request.headers);
   const responseCookies = [];
+  const inboundPreprHeaders = [];
+  requestHeaders.forEach((_value, key) => {
+    if (key.toLowerCase().startsWith("prepr-")) {
+      inboundPreprHeaders.push(key);
+    }
+  });
+  for (const key of inboundPreprHeaders) {
+    requestHeaders.delete(key);
+  }
   const requestCookies = parseCookies(request);
   const url = new URL(request.url);
   const searchParams = url.searchParams;
@@ -114,25 +128,28 @@ function processPreprRequest(request, opts) {
   for (const key of UTM_PARAMS) {
     const value = searchParams.get(key);
     if (value !== null) {
-      requestHeaders.set(`Prepr-Context-${key}`, value);
+      requestHeaders.set(`Prepr-Context-${key}`, sanitizeHeaderValue(value));
     }
   }
   const referer = request.headers.get("referer");
   if (referer) {
-    requestHeaders.set("Prepr-Context-initial_referral", referer);
+    requestHeaders.set(
+      "Prepr-Context-initial_referral",
+      sanitizeHeaderValue(referer)
+    );
   }
   const userAgent = request.headers.get("user-agent");
   if (userAgent) {
-    requestHeaders.set("Prepr-User-Agent", userAgent);
+    requestHeaders.set("Prepr-User-Agent", sanitizeHeaderValue(userAgent));
   }
   requestHeaders.set("Prepr-Package", `@preprio/toolkit@${opts?.version ?? VERSION}`);
   const ip = request.headers.get("Cf-Connecting-Ip") ?? request.headers.get("x-real-ip");
   if (ip) {
-    requestHeaders.set("Prepr-Visitor-IP", ip);
+    requestHeaders.set("Prepr-Visitor-IP", sanitizeHeaderValue(ip));
   }
   const hutkCookie = requestCookies.get(COOKIE_HUBSPOT);
   if (hutkCookie) {
-    requestHeaders.set("Prepr-Hubspot-Id", hutkCookie);
+    requestHeaders.set("Prepr-Hubspot-Id", sanitizeHeaderValue(hutkCookie));
   }
   let uid = requestCookies.get(COOKIE_UID);
   if (!uid) {
@@ -172,16 +189,16 @@ function processPreprRequest(request, opts) {
   if (!isLivePreview) {
     const segmentCookie = features.segments ? requestCookies.get(COOKIE_SEGMENT) : void 0;
     if (segmentCookie) {
-      requestHeaders.set("Prepr-Segments", segmentCookie);
+      requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(segmentCookie));
     }
     const abCookie = features.abTesting ? requestCookies.get(COOKIE_VARIANT) : void 0;
     if (abCookie) {
-      requestHeaders.set("Prepr-ABtesting", abCookie);
+      requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(abCookie));
     }
   }
   const previewAb = features.abTesting ? searchParams.get(PARAM_VARIANT) : null;
   if (previewAb !== null) {
-    requestHeaders.set("Prepr-ABtesting", previewAb);
+    requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(previewAb));
     if (!isLivePreview) {
       responseCookies.push({
         name: COOKIE_VARIANT,
@@ -194,7 +211,7 @@ function processPreprRequest(request, opts) {
   }
   const previewSegment = features.segments ? searchParams.get(PARAM_SEGMENT) : null;
   if (previewSegment !== null) {
-    requestHeaders.set("Prepr-Segments", previewSegment);
+    requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(previewSegment));
     if (!isLivePreview) {
       responseCookies.push({
         name: COOKIE_SEGMENT,

package/dist/nuxt/index.js

@@ -1,5 +1,5 @@
 // src/version.ts
-var VERSION = "0.2.0-beta.5";
+var VERSION = "0.2.0-beta.6";
 
 // src/core/constants.ts
 var COOKIE_PREVIEW_MODE = "Prepr-Preview-Mode";
@@ -38,6 +38,11 @@ var UTM_PARAMS = [
   "utm_content",
   "utm_campaign"
 ];
+var MAX_HEADER_VALUE_LENGTH = 2048;
+function sanitizeHeaderValue(value) {
+  const stripped = value.replace(/[\u0000-\u001f\u007f]/g, "");
+  return stripped.length > MAX_HEADER_VALUE_LENGTH ? stripped.slice(0, MAX_HEADER_VALUE_LENGTH) : stripped;
+}
 function serializeCookie(cookie) {
   const parts = [
     `${cookie.name}=${encodeURIComponent(cookie.value)}`,
@@ -69,6 +74,15 @@ function parseCookies(request) {
 function processPreprRequest(request, opts) {
   const requestHeaders = new Headers(request.headers);
   const responseCookies = [];
+  const inboundPreprHeaders = [];
+  requestHeaders.forEach((_value, key) => {
+    if (key.toLowerCase().startsWith("prepr-")) {
+      inboundPreprHeaders.push(key);
+    }
+  });
+  for (const key of inboundPreprHeaders) {
+    requestHeaders.delete(key);
+  }
   const requestCookies = parseCookies(request);
   const url = new URL(request.url);
   const searchParams = url.searchParams;
@@ -78,25 +92,28 @@ function processPreprRequest(request, opts) {
   for (const key of UTM_PARAMS) {
     const value = searchParams.get(key);
     if (value !== null) {
-      requestHeaders.set(`Prepr-Context-${key}`, value);
+      requestHeaders.set(`Prepr-Context-${key}`, sanitizeHeaderValue(value));
     }
   }
   const referer = request.headers.get("referer");
   if (referer) {
-    requestHeaders.set("Prepr-Context-initial_referral", referer);
+    requestHeaders.set(
+      "Prepr-Context-initial_referral",
+      sanitizeHeaderValue(referer)
+    );
   }
   const userAgent = request.headers.get("user-agent");
   if (userAgent) {
-    requestHeaders.set("Prepr-User-Agent", userAgent);
+    requestHeaders.set("Prepr-User-Agent", sanitizeHeaderValue(userAgent));
   }
   requestHeaders.set("Prepr-Package", `@preprio/toolkit@${opts?.version ?? VERSION}`);
   const ip = request.headers.get("Cf-Connecting-Ip") ?? request.headers.get("x-real-ip");
   if (ip) {
-    requestHeaders.set("Prepr-Visitor-IP", ip);
+    requestHeaders.set("Prepr-Visitor-IP", sanitizeHeaderValue(ip));
   }
   const hutkCookie = requestCookies.get(COOKIE_HUBSPOT);
   if (hutkCookie) {
-    requestHeaders.set("Prepr-Hubspot-Id", hutkCookie);
+    requestHeaders.set("Prepr-Hubspot-Id", sanitizeHeaderValue(hutkCookie));
   }
   let uid = requestCookies.get(COOKIE_UID);
   if (!uid) {
@@ -136,16 +153,16 @@ function processPreprRequest(request, opts) {
   if (!isLivePreview) {
     const segmentCookie = features.segments ? requestCookies.get(COOKIE_SEGMENT) : void 0;
     if (segmentCookie) {
-      requestHeaders.set("Prepr-Segments", segmentCookie);
+      requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(segmentCookie));
     }
     const abCookie = features.abTesting ? requestCookies.get(COOKIE_VARIANT) : void 0;
     if (abCookie) {
-      requestHeaders.set("Prepr-ABtesting", abCookie);
+      requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(abCookie));
     }
   }
   const previewAb = features.abTesting ? searchParams.get(PARAM_VARIANT) : null;
   if (previewAb !== null) {
-    requestHeaders.set("Prepr-ABtesting", previewAb);
+    requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(previewAb));
     if (!isLivePreview) {
       responseCookies.push({
         name: COOKIE_VARIANT,
@@ -158,7 +175,7 @@ function processPreprRequest(request, opts) {
   }
   const previewSegment = features.segments ? searchParams.get(PARAM_SEGMENT) : null;
   if (previewSegment !== null) {
-    requestHeaders.set("Prepr-Segments", previewSegment);
+    requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(previewSegment));
     if (!isLivePreview) {
       responseCookies.push({
         name: COOKIE_SEGMENT,

package/dist/react/components.cjs

@@ -334,7 +334,10 @@ function createIframeBridge(store, options = {}) {
   };
   return {
     start() {
-      sendPreprEvent("loaded", void 0, { allowUntrustedTarget: true });
+      const features = store?.get().features;
+      sendPreprEvent("loaded", features ? { features } : void 0, {
+        allowUntrustedTarget: true
+      });
       window.addEventListener("keydown", onKeyDown);
       window.addEventListener("message", onMessage);
     },
@@ -2049,6 +2052,14 @@ function defaultNavigation() {
     currentPath: () => window.location.pathname + window.location.search
   };
 }
+function safeEditUrl(href) {
+  try {
+    const url = new URL(href, window.location.href);
+    return url.protocol === "https:" || url.protocol === "http:" ? url.href : null;
+  } catch {
+    return null;
+  }
+}
 function buildSegments(data) {
   return [{ _id: "all_other_users", name: "All other users" }, ...data];
 }
@@ -2112,10 +2123,20 @@ function createPreprPreview(opts = {}) {
     // In the editor, ask the parent to focus the field instead of opening a new
     // tab. Standalone previews keep the window.open behaviour.
     onEdit: ({ href, origin, id, field }) => {
+      const safeHref = href ? safeEditUrl(href) : null;
+      if (href && !safeHref) {
+        debug7.warn("ignored edit request with unsupported href scheme");
+        return;
+      }
       if (isIframe) {
-        sendPreprEvent("field_edit_requested", { href, origin, id, field });
-      } else if (href) {
-        window.open(href);
+        sendPreprEvent("field_edit_requested", {
+          href: safeHref ?? void 0,
+          origin,
+          id,
+          field
+        });
+      } else if (safeHref) {
+        window.open(safeHref, "_blank", "noopener,noreferrer");
       }
     }
   });

package/dist/react/components.js

@@ -310,7 +310,10 @@ function createIframeBridge(store, options = {}) {
   };
   return {
     start() {
-      sendPreprEvent("loaded", void 0, { allowUntrustedTarget: true });
+      const features = store?.get().features;
+      sendPreprEvent("loaded", features ? { features } : void 0, {
+        allowUntrustedTarget: true
+      });
       window.addEventListener("keydown", onKeyDown);
       window.addEventListener("message", onMessage);
     },
@@ -2025,6 +2028,14 @@ function defaultNavigation() {
     currentPath: () => window.location.pathname + window.location.search
   };
 }
+function safeEditUrl(href) {
+  try {
+    const url = new URL(href, window.location.href);
+    return url.protocol === "https:" || url.protocol === "http:" ? url.href : null;
+  } catch {
+    return null;
+  }
+}
 function buildSegments(data) {
   return [{ _id: "all_other_users", name: "All other users" }, ...data];
 }
@@ -2088,10 +2099,20 @@ function createPreprPreview(opts = {}) {
     // In the editor, ask the parent to focus the field instead of opening a new
     // tab. Standalone previews keep the window.open behaviour.
     onEdit: ({ href, origin, id, field }) => {
+      const safeHref = href ? safeEditUrl(href) : null;
+      if (href && !safeHref) {
+        debug7.warn("ignored edit request with unsupported href scheme");
+        return;
+      }
       if (isIframe) {
-        sendPreprEvent("field_edit_requested", { href, origin, id, field });
-      } else if (href) {
-        window.open(href);
+        sendPreprEvent("field_edit_requested", {
+          href: safeHref ?? void 0,
+          origin,
+          id,
+          field
+        });
+      } else if (safeHref) {
+        window.open(safeHref, "_blank", "noopener,noreferrer");
       }
     }
   });

package/dist/sveltekit/index.cjs

@@ -35,7 +35,7 @@ __export(sveltekit_exports, {
 module.exports = __toCommonJS(sveltekit_exports);
 
 // src/version.ts
-var VERSION = "0.2.0-beta.5";
+var VERSION = "0.2.0-beta.6";
 
 // src/core/constants.ts
 var COOKIE_PREVIEW_MODE = "Prepr-Preview-Mode";
@@ -74,6 +74,11 @@ var UTM_PARAMS = [
   "utm_content",
   "utm_campaign"
 ];
+var MAX_HEADER_VALUE_LENGTH = 2048;
+function sanitizeHeaderValue(value) {
+  const stripped = value.replace(/[\u0000-\u001f\u007f]/g, "");
+  return stripped.length > MAX_HEADER_VALUE_LENGTH ? stripped.slice(0, MAX_HEADER_VALUE_LENGTH) : stripped;
+}
 function serializeCookie(cookie) {
   const parts = [
     `${cookie.name}=${encodeURIComponent(cookie.value)}`,
@@ -105,6 +110,15 @@ function parseCookies(request) {
 function processPreprRequest(request, opts) {
   const requestHeaders = new Headers(request.headers);
   const responseCookies = [];
+  const inboundPreprHeaders = [];
+  requestHeaders.forEach((_value, key) => {
+    if (key.toLowerCase().startsWith("prepr-")) {
+      inboundPreprHeaders.push(key);
+    }
+  });
+  for (const key of inboundPreprHeaders) {
+    requestHeaders.delete(key);
+  }
   const requestCookies = parseCookies(request);
   const url = new URL(request.url);
   const searchParams = url.searchParams;
@@ -114,25 +128,28 @@ function processPreprRequest(request, opts) {
   for (const key of UTM_PARAMS) {
     const value = searchParams.get(key);
     if (value !== null) {
-      requestHeaders.set(`Prepr-Context-${key}`, value);
+      requestHeaders.set(`Prepr-Context-${key}`, sanitizeHeaderValue(value));
     }
   }
   const referer = request.headers.get("referer");
   if (referer) {
-    requestHeaders.set("Prepr-Context-initial_referral", referer);
+    requestHeaders.set(
+      "Prepr-Context-initial_referral",
+      sanitizeHeaderValue(referer)
+    );
   }
   const userAgent = request.headers.get("user-agent");
   if (userAgent) {
-    requestHeaders.set("Prepr-User-Agent", userAgent);
+    requestHeaders.set("Prepr-User-Agent", sanitizeHeaderValue(userAgent));
   }
   requestHeaders.set("Prepr-Package", `@preprio/toolkit@${opts?.version ?? VERSION}`);
   const ip = request.headers.get("Cf-Connecting-Ip") ?? request.headers.get("x-real-ip");
   if (ip) {
-    requestHeaders.set("Prepr-Visitor-IP", ip);
+    requestHeaders.set("Prepr-Visitor-IP", sanitizeHeaderValue(ip));
   }
   const hutkCookie = requestCookies.get(COOKIE_HUBSPOT);
   if (hutkCookie) {
-    requestHeaders.set("Prepr-Hubspot-Id", hutkCookie);
+    requestHeaders.set("Prepr-Hubspot-Id", sanitizeHeaderValue(hutkCookie));
   }
   let uid = requestCookies.get(COOKIE_UID);
   if (!uid) {
@@ -172,16 +189,16 @@ function processPreprRequest(request, opts) {
   if (!isLivePreview) {
     const segmentCookie = features.segments ? requestCookies.get(COOKIE_SEGMENT) : void 0;
     if (segmentCookie) {
-      requestHeaders.set("Prepr-Segments", segmentCookie);
+      requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(segmentCookie));
     }
     const abCookie = features.abTesting ? requestCookies.get(COOKIE_VARIANT) : void 0;
     if (abCookie) {
-      requestHeaders.set("Prepr-ABtesting", abCookie);
+      requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(abCookie));
     }
   }
   const previewAb = features.abTesting ? searchParams.get(PARAM_VARIANT) : null;
   if (previewAb !== null) {
-    requestHeaders.set("Prepr-ABtesting", previewAb);
+    requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(previewAb));
     if (!isLivePreview) {
       responseCookies.push({
         name: COOKIE_VARIANT,
@@ -194,7 +211,7 @@ function processPreprRequest(request, opts) {
   }
   const previewSegment = features.segments ? searchParams.get(PARAM_SEGMENT) : null;
   if (previewSegment !== null) {
-    requestHeaders.set("Prepr-Segments", previewSegment);
+    requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(previewSegment));
     if (!isLivePreview) {
       responseCookies.push({
         name: COOKIE_SEGMENT,

package/dist/sveltekit/index.js

@@ -1,5 +1,5 @@
 // src/version.ts
-var VERSION = "0.2.0-beta.5";
+var VERSION = "0.2.0-beta.6";
 
 // src/core/constants.ts
 var COOKIE_PREVIEW_MODE = "Prepr-Preview-Mode";
@@ -38,6 +38,11 @@ var UTM_PARAMS = [
   "utm_content",
   "utm_campaign"
 ];
+var MAX_HEADER_VALUE_LENGTH = 2048;
+function sanitizeHeaderValue(value) {
+  const stripped = value.replace(/[\u0000-\u001f\u007f]/g, "");
+  return stripped.length > MAX_HEADER_VALUE_LENGTH ? stripped.slice(0, MAX_HEADER_VALUE_LENGTH) : stripped;
+}
 function serializeCookie(cookie) {
   const parts = [
     `${cookie.name}=${encodeURIComponent(cookie.value)}`,
@@ -69,6 +74,15 @@ function parseCookies(request) {
 function processPreprRequest(request, opts) {
   const requestHeaders = new Headers(request.headers);
   const responseCookies = [];
+  const inboundPreprHeaders = [];
+  requestHeaders.forEach((_value, key) => {
+    if (key.toLowerCase().startsWith("prepr-")) {
+      inboundPreprHeaders.push(key);
+    }
+  });
+  for (const key of inboundPreprHeaders) {
+    requestHeaders.delete(key);
+  }
   const requestCookies = parseCookies(request);
   const url = new URL(request.url);
   const searchParams = url.searchParams;
@@ -78,25 +92,28 @@ function processPreprRequest(request, opts) {
   for (const key of UTM_PARAMS) {
     const value = searchParams.get(key);
     if (value !== null) {
-      requestHeaders.set(`Prepr-Context-${key}`, value);
+      requestHeaders.set(`Prepr-Context-${key}`, sanitizeHeaderValue(value));
     }
   }
   const referer = request.headers.get("referer");
   if (referer) {
-    requestHeaders.set("Prepr-Context-initial_referral", referer);
+    requestHeaders.set(
+      "Prepr-Context-initial_referral",
+      sanitizeHeaderValue(referer)
+    );
   }
   const userAgent = request.headers.get("user-agent");
   if (userAgent) {
-    requestHeaders.set("Prepr-User-Agent", userAgent);
+    requestHeaders.set("Prepr-User-Agent", sanitizeHeaderValue(userAgent));
   }
   requestHeaders.set("Prepr-Package", `@preprio/toolkit@${opts?.version ?? VERSION}`);
   const ip = request.headers.get("Cf-Connecting-Ip") ?? request.headers.get("x-real-ip");
   if (ip) {
-    requestHeaders.set("Prepr-Visitor-IP", ip);
+    requestHeaders.set("Prepr-Visitor-IP", sanitizeHeaderValue(ip));
   }
   const hutkCookie = requestCookies.get(COOKIE_HUBSPOT);
   if (hutkCookie) {
-    requestHeaders.set("Prepr-Hubspot-Id", hutkCookie);
+    requestHeaders.set("Prepr-Hubspot-Id", sanitizeHeaderValue(hutkCookie));
   }
   let uid = requestCookies.get(COOKIE_UID);
   if (!uid) {
@@ -136,16 +153,16 @@ function processPreprRequest(request, opts) {
   if (!isLivePreview) {
     const segmentCookie = features.segments ? requestCookies.get(COOKIE_SEGMENT) : void 0;
     if (segmentCookie) {
-      requestHeaders.set("Prepr-Segments", segmentCookie);
+      requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(segmentCookie));
     }
     const abCookie = features.abTesting ? requestCookies.get(COOKIE_VARIANT) : void 0;
     if (abCookie) {
-      requestHeaders.set("Prepr-ABtesting", abCookie);
+      requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(abCookie));
     }
   }
   const previewAb = features.abTesting ? searchParams.get(PARAM_VARIANT) : null;
   if (previewAb !== null) {
-    requestHeaders.set("Prepr-ABtesting", previewAb);
+    requestHeaders.set("Prepr-ABtesting", sanitizeHeaderValue(previewAb));
     if (!isLivePreview) {
       responseCookies.push({
         name: COOKIE_VARIANT,
@@ -158,7 +175,7 @@ function processPreprRequest(request, opts) {
   }
   const previewSegment = features.segments ? searchParams.get(PARAM_SEGMENT) : null;
   if (previewSegment !== null) {
-    requestHeaders.set("Prepr-Segments", previewSegment);
+    requestHeaders.set("Prepr-Segments", sanitizeHeaderValue(previewSegment));
     if (!isLivePreview) {
       responseCookies.push({
         name: COOKIE_SEGMENT,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@preprio/toolkit",
-  "version": "0.2.0-beta.5",
+  "version": "0.2.0-beta.6",
   "description": "Prepr personalization, A/B testing and preview toolkit for React, Next.js, Nuxt, Astro, SvelteKit and Express",
   "license": "Apache-2.0",
   "author": "Prepr B.V. (https://prepr.io)",