@solidjs/web 2.0.0-rc.1 → 2.0.0-rc.3

package/server-functions/dist/server.cjs

@@ -362,6 +362,7 @@ async function decodeResponsePayload(response, codecOptions) {
   };
 }
 
+typeof setImmediate === "function" ? setImmediate : fn => setTimeout(fn, 0);
 const RequestContext = Symbol.for("solid.RequestContext");
 function getRequestEvent() {
   return globalThis[RequestContext] ? globalThis[RequestContext].getStore() || solidJs.sharedConfig.context && solidJs.sharedConfig.context.event || console.warn("RequestEvent is missing. This is most likely due to accessing `getRequestEvent` non-managed async scope in a partially polyfilled environment. Try moving it above all `await` calls.") : undefined;
@@ -493,7 +494,8 @@ const config = {
   transformFlightResult: undefined,
   transformDirectResult: undefined,
   handleNoJS: undefined,
-  endpoint: "/_server"
+  endpoint: "/_server",
+  csrf: true
 };
 function configureServerFunctionsServer({
   provideEvent,
@@ -504,6 +506,7 @@ function configureServerFunctionsServer({
   transformDirectResult,
   handleNoJS,
   endpoint,
+  csrf,
   codec
 } = {}) {
   if (provideEvent !== undefined) config.provideEvent = provideEvent;
@@ -514,6 +517,7 @@ function configureServerFunctionsServer({
   if (transformDirectResult !== undefined) config.transformDirectResult = transformDirectResult;
   if (handleNoJS !== undefined) config.handleNoJS = handleNoJS;
   if (endpoint !== undefined) config.endpoint = endpoint;
+  if (csrf !== undefined) config.csrf = csrf;
   if (codec !== undefined) configureServerFunctionsCodec(codec);
 }
 function provideEvent(event, fn) {
@@ -950,31 +954,96 @@ function sanitizeServerError(value) {
   if (isSafeError(value)) return value;
   return new Error(GENERIC_SERVER_ERROR_MESSAGE);
 }
+function observeServerFunctionCalls() {
+  return () => {};
+}
+async function matchesOrigin(origin, request, matcher) {
+  if (matcher === undefined) return origin === new URL(request.url).origin;
+  if (typeof matcher === "function") return !!(await matcher(origin, request));
+  return Array.isArray(matcher) ? matcher.includes(origin) : origin === matcher;
+}
+async function allowsServerFunctionRequest(request, options) {
+  const fetchSite = request.headers.get("Sec-Fetch-Site");
+  if (fetchSite === "same-origin") return true;
+  if (fetchSite === "same-site" || fetchSite === "cross-site" || fetchSite === "none") {
+    return false;
+  }
+  const origin = request.headers.get("Origin");
+  if (origin !== null) return matchesOrigin(origin, request, options.origin);
+  const referer = request.headers.get("Referer");
+  if (referer !== null) {
+    try {
+      return matchesOrigin(new URL(referer).origin, request, options.origin);
+    } catch {
+      return false;
+    }
+  }
+  return options.allowRequestsWithoutOriginCheck === true;
+}
+const CSRF_VARY = ["Sec-Fetch-Site", "Origin", "Referer"];
+function withCSRFVary(response) {
+  const current = response.headers.get("Vary");
+  if (current === "*") return response;
+  const values = current ? current.split(",").map(value => value.trim()) : [];
+  const names = new Set(values.map(value => value.toLowerCase()));
+  for (const value of CSRF_VARY) {
+    if (!names.has(value.toLowerCase())) values.push(value);
+  }
+  const vary = values.join(", ");
+  try {
+    response.headers.set("Vary", vary);
+    return response;
+  } catch {
+    const headers = new Headers(response.headers);
+    headers.set("Vary", vary);
+    return new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers
+    });
+  }
+}
+function forbiddenResponse() {
+  return withCSRFVary(new Response(DEV ? "Forbidden" : null, {
+    status: 403,
+    headers: {
+      "Cache-Control": "no-store"
+    }
+  }));
+}
 async function handleServerFunctionRequest(request, options = {}) {
   const codec = options.codec !== undefined ? options.codec : getServerFunctionsCodec();
   const url = new URL(request.url);
+  const csrf = options.csrf !== undefined ? options.csrf : config.csrf;
+  const protectsRequest = csrf !== false;
+  if (protectsRequest && !(await allowsServerFunctionRequest(request, csrf === true ? {} : csrf))) {
+    return forbiddenResponse();
+  }
   const instance = request.headers.get(INSTANCE_HEADER);
   const functionId = resolveFunctionId(request, url);
   if (!functionId) {
-    return new Response(DEV ? "Server function not found" : null, {
+    const response = new Response(DEV ? "Server function not found" : null, {
       status: 404
     });
+    return protectsRequest ? withCSRFVary(response) : response;
   }
   let serverFunction;
   try {
     serverFunction = getServerFunction(functionId);
   } catch {
-    return new Response(DEV ? `Unknown server function: ${functionId}` : null, {
+    const response = new Response(DEV ? `Unknown server function: ${functionId}` : null, {
       status: 404
     });
+    return protectsRequest ? withCSRFVary(response) : response;
   }
   if (request.method === "GET" && METHODS.get(functionId) !== "GET") {
-    return new Response(DEV ? `Method not allowed for server function: ${functionId}` : null, {
+    const response = new Response(DEV ? `Method not allowed for server function: ${functionId}` : null, {
       status: 405,
       headers: {
         Allow: "POST"
       }
     });
+    return protectsRequest ? withCSRFVary(response) : response;
   }
   const event = options.createEvent ? options.createEvent(request) : {
     request,
@@ -1133,7 +1202,8 @@ async function handleServerFunctionRequest(request, options = {}) {
       return encodeResult(safe, headers, 200, codec, request.signal);
     }
   };
-  return commitEventResponse(await dispatch(), event);
+  const response = commitEventResponse(await dispatch(), event);
+  return protectsRequest ? withCSRFVary(response) : response;
 }
 
 exports.ERROR_HEADER = ERROR_HEADER;
@@ -1162,6 +1232,7 @@ exports.handleServerFunctionRequest = handleServerFunctionRequest;
 exports.hasFlashCookie = hasFlashCookie;
 exports.isServerFunction = isServerFunction;
 exports.live = live;
+exports.observeServerFunctionCalls = observeServerFunctionCalls;
 exports.registerServerFunction = registerServerFunction;
 exports.registerServerReference = registerServerReference;
 exports.sanitizeServerError = sanitizeServerError;

package/server-functions/dist/server.dev.cjs

@@ -362,6 +362,7 @@ async function decodeResponsePayload(response, codecOptions) {
   };
 }
 
+typeof setImmediate === "function" ? setImmediate : fn => setTimeout(fn, 0);
 const RequestContext = Symbol.for("solid.RequestContext");
 function getRequestEvent() {
   return globalThis[RequestContext] ? globalThis[RequestContext].getStore() || solidJs.sharedConfig.context && solidJs.sharedConfig.context.event || console.warn("RequestEvent is missing. This is most likely due to accessing `getRequestEvent` non-managed async scope in a partially polyfilled environment. Try moving it above all `await` calls.") : undefined;
@@ -493,7 +494,8 @@ const config = {
   transformFlightResult: undefined,
   transformDirectResult: undefined,
   handleNoJS: undefined,
-  endpoint: "/_server"
+  endpoint: "/_server",
+  csrf: true
 };
 function configureServerFunctionsServer({
   provideEvent,
@@ -504,6 +506,7 @@ function configureServerFunctionsServer({
   transformDirectResult,
   handleNoJS,
   endpoint,
+  csrf,
   codec
 } = {}) {
   if (provideEvent !== undefined) config.provideEvent = provideEvent;
@@ -514,6 +517,7 @@ function configureServerFunctionsServer({
   if (transformDirectResult !== undefined) config.transformDirectResult = transformDirectResult;
   if (handleNoJS !== undefined) config.handleNoJS = handleNoJS;
   if (endpoint !== undefined) config.endpoint = endpoint;
+  if (csrf !== undefined) config.csrf = csrf;
   if (codec !== undefined) configureServerFunctionsCodec(codec);
 }
 function provideEvent(event, fn) {
@@ -950,31 +954,96 @@ function sanitizeServerError(value) {
   if (isSafeError(value)) return value;
   return new Error(GENERIC_SERVER_ERROR_MESSAGE);
 }
+function observeServerFunctionCalls() {
+  return () => {};
+}
+async function matchesOrigin(origin, request, matcher) {
+  if (matcher === undefined) return origin === new URL(request.url).origin;
+  if (typeof matcher === "function") return !!(await matcher(origin, request));
+  return Array.isArray(matcher) ? matcher.includes(origin) : origin === matcher;
+}
+async function allowsServerFunctionRequest(request, options) {
+  const fetchSite = request.headers.get("Sec-Fetch-Site");
+  if (fetchSite === "same-origin") return true;
+  if (fetchSite === "same-site" || fetchSite === "cross-site" || fetchSite === "none") {
+    return false;
+  }
+  const origin = request.headers.get("Origin");
+  if (origin !== null) return matchesOrigin(origin, request, options.origin);
+  const referer = request.headers.get("Referer");
+  if (referer !== null) {
+    try {
+      return matchesOrigin(new URL(referer).origin, request, options.origin);
+    } catch {
+      return false;
+    }
+  }
+  return options.allowRequestsWithoutOriginCheck === true;
+}
+const CSRF_VARY = ["Sec-Fetch-Site", "Origin", "Referer"];
+function withCSRFVary(response) {
+  const current = response.headers.get("Vary");
+  if (current === "*") return response;
+  const values = current ? current.split(",").map(value => value.trim()) : [];
+  const names = new Set(values.map(value => value.toLowerCase()));
+  for (const value of CSRF_VARY) {
+    if (!names.has(value.toLowerCase())) values.push(value);
+  }
+  const vary = values.join(", ");
+  try {
+    response.headers.set("Vary", vary);
+    return response;
+  } catch {
+    const headers = new Headers(response.headers);
+    headers.set("Vary", vary);
+    return new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers
+    });
+  }
+}
+function forbiddenResponse() {
+  return withCSRFVary(new Response(DEV ? "Forbidden" : null, {
+    status: 403,
+    headers: {
+      "Cache-Control": "no-store"
+    }
+  }));
+}
 async function handleServerFunctionRequest(request, options = {}) {
   const codec = options.codec !== undefined ? options.codec : getServerFunctionsCodec();
   const url = new URL(request.url);
+  const csrf = options.csrf !== undefined ? options.csrf : config.csrf;
+  const protectsRequest = csrf !== false;
+  if (protectsRequest && !(await allowsServerFunctionRequest(request, csrf === true ? {} : csrf))) {
+    return forbiddenResponse();
+  }
   const instance = request.headers.get(INSTANCE_HEADER);
   const functionId = resolveFunctionId(request, url);
   if (!functionId) {
-    return new Response(DEV ? "Server function not found" : null, {
+    const response = new Response(DEV ? "Server function not found" : null, {
       status: 404
     });
+    return protectsRequest ? withCSRFVary(response) : response;
   }
   let serverFunction;
   try {
     serverFunction = getServerFunction(functionId);
   } catch {
-    return new Response(DEV ? `Unknown server function: ${functionId}` : null, {
+    const response = new Response(DEV ? `Unknown server function: ${functionId}` : null, {
       status: 404
     });
+    return protectsRequest ? withCSRFVary(response) : response;
   }
   if (request.method === "GET" && METHODS.get(functionId) !== "GET") {
-    return new Response(DEV ? `Method not allowed for server function: ${functionId}` : null, {
+    const response = new Response(DEV ? `Method not allowed for server function: ${functionId}` : null, {
       status: 405,
       headers: {
         Allow: "POST"
       }
     });
+    return protectsRequest ? withCSRFVary(response) : response;
   }
   const event = options.createEvent ? options.createEvent(request) : {
     request,
@@ -1133,7 +1202,8 @@ async function handleServerFunctionRequest(request, options = {}) {
       return encodeResult(safe, headers, 200, codec, request.signal);
     }
   };
-  return commitEventResponse(await dispatch(), event);
+  const response = commitEventResponse(await dispatch(), event);
+  return protectsRequest ? withCSRFVary(response) : response;
 }
 
 exports.ERROR_HEADER = ERROR_HEADER;
@@ -1162,6 +1232,7 @@ exports.handleServerFunctionRequest = handleServerFunctionRequest;
 exports.hasFlashCookie = hasFlashCookie;
 exports.isServerFunction = isServerFunction;
 exports.live = live;
+exports.observeServerFunctionCalls = observeServerFunctionCalls;
 exports.registerServerFunction = registerServerFunction;
 exports.registerServerReference = registerServerReference;
 exports.sanitizeServerError = sanitizeServerError;

package/server-functions/dist/server.dev.js

@@ -360,6 +360,7 @@ async function decodeResponsePayload(response, codecOptions) {
   };
 }
 
+typeof setImmediate === "function" ? setImmediate : fn => setTimeout(fn, 0);
 const RequestContext = Symbol.for("solid.RequestContext");
 function getRequestEvent() {
   return globalThis[RequestContext] ? globalThis[RequestContext].getStore() || sharedConfig.context && sharedConfig.context.event || console.warn("RequestEvent is missing. This is most likely due to accessing `getRequestEvent` non-managed async scope in a partially polyfilled environment. Try moving it above all `await` calls.") : undefined;
@@ -491,7 +492,8 @@ const config = {
   transformFlightResult: undefined,
   transformDirectResult: undefined,
   handleNoJS: undefined,
-  endpoint: "/_server"
+  endpoint: "/_server",
+  csrf: true
 };
 function configureServerFunctionsServer({
   provideEvent,
@@ -502,6 +504,7 @@ function configureServerFunctionsServer({
   transformDirectResult,
   handleNoJS,
   endpoint,
+  csrf,
   codec
 } = {}) {
   if (provideEvent !== undefined) config.provideEvent = provideEvent;
@@ -512,6 +515,7 @@ function configureServerFunctionsServer({
   if (transformDirectResult !== undefined) config.transformDirectResult = transformDirectResult;
   if (handleNoJS !== undefined) config.handleNoJS = handleNoJS;
   if (endpoint !== undefined) config.endpoint = endpoint;
+  if (csrf !== undefined) config.csrf = csrf;
   if (codec !== undefined) configureServerFunctionsCodec(codec);
 }
 function provideEvent(event, fn) {
@@ -948,31 +952,96 @@ function sanitizeServerError(value) {
   if (isSafeError(value)) return value;
   return new Error(GENERIC_SERVER_ERROR_MESSAGE);
 }
+function observeServerFunctionCalls() {
+  return () => {};
+}
+async function matchesOrigin(origin, request, matcher) {
+  if (matcher === undefined) return origin === new URL(request.url).origin;
+  if (typeof matcher === "function") return !!(await matcher(origin, request));
+  return Array.isArray(matcher) ? matcher.includes(origin) : origin === matcher;
+}
+async function allowsServerFunctionRequest(request, options) {
+  const fetchSite = request.headers.get("Sec-Fetch-Site");
+  if (fetchSite === "same-origin") return true;
+  if (fetchSite === "same-site" || fetchSite === "cross-site" || fetchSite === "none") {
+    return false;
+  }
+  const origin = request.headers.get("Origin");
+  if (origin !== null) return matchesOrigin(origin, request, options.origin);
+  const referer = request.headers.get("Referer");
+  if (referer !== null) {
+    try {
+      return matchesOrigin(new URL(referer).origin, request, options.origin);
+    } catch {
+      return false;
+    }
+  }
+  return options.allowRequestsWithoutOriginCheck === true;
+}
+const CSRF_VARY = ["Sec-Fetch-Site", "Origin", "Referer"];
+function withCSRFVary(response) {
+  const current = response.headers.get("Vary");
+  if (current === "*") return response;
+  const values = current ? current.split(",").map(value => value.trim()) : [];
+  const names = new Set(values.map(value => value.toLowerCase()));
+  for (const value of CSRF_VARY) {
+    if (!names.has(value.toLowerCase())) values.push(value);
+  }
+  const vary = values.join(", ");
+  try {
+    response.headers.set("Vary", vary);
+    return response;
+  } catch {
+    const headers = new Headers(response.headers);
+    headers.set("Vary", vary);
+    return new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers
+    });
+  }
+}
+function forbiddenResponse() {
+  return withCSRFVary(new Response(DEV ? "Forbidden" : null, {
+    status: 403,
+    headers: {
+      "Cache-Control": "no-store"
+    }
+  }));
+}
 async function handleServerFunctionRequest(request, options = {}) {
   const codec = options.codec !== undefined ? options.codec : getServerFunctionsCodec();
   const url = new URL(request.url);
+  const csrf = options.csrf !== undefined ? options.csrf : config.csrf;
+  const protectsRequest = csrf !== false;
+  if (protectsRequest && !(await allowsServerFunctionRequest(request, csrf === true ? {} : csrf))) {
+    return forbiddenResponse();
+  }
   const instance = request.headers.get(INSTANCE_HEADER);
   const functionId = resolveFunctionId(request, url);
   if (!functionId) {
-    return new Response(DEV ? "Server function not found" : null, {
+    const response = new Response(DEV ? "Server function not found" : null, {
       status: 404
     });
+    return protectsRequest ? withCSRFVary(response) : response;
   }
   let serverFunction;
   try {
     serverFunction = getServerFunction(functionId);
   } catch {
-    return new Response(DEV ? `Unknown server function: ${functionId}` : null, {
+    const response = new Response(DEV ? `Unknown server function: ${functionId}` : null, {
       status: 404
     });
+    return protectsRequest ? withCSRFVary(response) : response;
   }
   if (request.method === "GET" && METHODS.get(functionId) !== "GET") {
-    return new Response(DEV ? `Method not allowed for server function: ${functionId}` : null, {
+    const response = new Response(DEV ? `Method not allowed for server function: ${functionId}` : null, {
       status: 405,
       headers: {
         Allow: "POST"
       }
     });
+    return protectsRequest ? withCSRFVary(response) : response;
   }
   const event = options.createEvent ? options.createEvent(request) : {
     request,
@@ -1131,7 +1200,8 @@ async function handleServerFunctionRequest(request, options = {}) {
       return encodeResult(safe, headers, 200, codec, request.signal);
     }
   };
-  return commitEventResponse(await dispatch(), event);
+  const response = commitEventResponse(await dispatch(), event);
+  return protectsRequest ? withCSRFVary(response) : response;
 }
 
-export { ERROR_HEADER, FLASH_COOKIE, FUNCTION_HEADER, GENERIC_SERVER_ERROR_MESSAGE, GET, INSTANCE_HEADER, SINGLE_FLIGHT_HEADER, clearFlashCookie, configureServerFunctionsServer, createNoJSHandler, createServerReference, decodeErrorHeaderValue, decodeFlashCookie, decodeResponse, decodeResponsePayload, encodeErrorHeaderValue, encodeFlashCookie, foldSetCookies, getEventServerFunctionInvocation, getServerFunction, getServerFunctionInvocation, getServerFunctionMetadata, handleServerFunctionRequest, hasFlashCookie, isServerFunction, live, registerServerFunction, registerServerReference, sanitizeServerError, serializeResponseStream, setServerFunctionsDev, subscribeFlightData, withMeta };
+export { ERROR_HEADER, FLASH_COOKIE, FUNCTION_HEADER, GENERIC_SERVER_ERROR_MESSAGE, GET, INSTANCE_HEADER, SINGLE_FLIGHT_HEADER, clearFlashCookie, configureServerFunctionsServer, createNoJSHandler, createServerReference, decodeErrorHeaderValue, decodeFlashCookie, decodeResponse, decodeResponsePayload, encodeErrorHeaderValue, encodeFlashCookie, foldSetCookies, getEventServerFunctionInvocation, getServerFunction, getServerFunctionInvocation, getServerFunctionMetadata, handleServerFunctionRequest, hasFlashCookie, isServerFunction, live, observeServerFunctionCalls, registerServerFunction, registerServerReference, sanitizeServerError, serializeResponseStream, setServerFunctionsDev, subscribeFlightData, withMeta };

package/server-functions/dist/server.js

@@ -360,6 +360,7 @@ async function decodeResponsePayload(response, codecOptions) {
   };
 }
 
+typeof setImmediate === "function" ? setImmediate : fn => setTimeout(fn, 0);
 const RequestContext = Symbol.for("solid.RequestContext");
 function getRequestEvent() {
   return globalThis[RequestContext] ? globalThis[RequestContext].getStore() || sharedConfig.context && sharedConfig.context.event || console.warn("RequestEvent is missing. This is most likely due to accessing `getRequestEvent` non-managed async scope in a partially polyfilled environment. Try moving it above all `await` calls.") : undefined;
@@ -491,7 +492,8 @@ const config = {
   transformFlightResult: undefined,
   transformDirectResult: undefined,
   handleNoJS: undefined,
-  endpoint: "/_server"
+  endpoint: "/_server",
+  csrf: true
 };
 function configureServerFunctionsServer({
   provideEvent,
@@ -502,6 +504,7 @@ function configureServerFunctionsServer({
   transformDirectResult,
   handleNoJS,
   endpoint,
+  csrf,
   codec
 } = {}) {
   if (provideEvent !== undefined) config.provideEvent = provideEvent;
@@ -512,6 +515,7 @@ function configureServerFunctionsServer({
   if (transformDirectResult !== undefined) config.transformDirectResult = transformDirectResult;
   if (handleNoJS !== undefined) config.handleNoJS = handleNoJS;
   if (endpoint !== undefined) config.endpoint = endpoint;
+  if (csrf !== undefined) config.csrf = csrf;
   if (codec !== undefined) configureServerFunctionsCodec(codec);
 }
 function provideEvent(event, fn) {
@@ -948,31 +952,96 @@ function sanitizeServerError(value) {
   if (isSafeError(value)) return value;
   return new Error(GENERIC_SERVER_ERROR_MESSAGE);
 }
+function observeServerFunctionCalls() {
+  return () => {};
+}
+async function matchesOrigin(origin, request, matcher) {
+  if (matcher === undefined) return origin === new URL(request.url).origin;
+  if (typeof matcher === "function") return !!(await matcher(origin, request));
+  return Array.isArray(matcher) ? matcher.includes(origin) : origin === matcher;
+}
+async function allowsServerFunctionRequest(request, options) {
+  const fetchSite = request.headers.get("Sec-Fetch-Site");
+  if (fetchSite === "same-origin") return true;
+  if (fetchSite === "same-site" || fetchSite === "cross-site" || fetchSite === "none") {
+    return false;
+  }
+  const origin = request.headers.get("Origin");
+  if (origin !== null) return matchesOrigin(origin, request, options.origin);
+  const referer = request.headers.get("Referer");
+  if (referer !== null) {
+    try {
+      return matchesOrigin(new URL(referer).origin, request, options.origin);
+    } catch {
+      return false;
+    }
+  }
+  return options.allowRequestsWithoutOriginCheck === true;
+}
+const CSRF_VARY = ["Sec-Fetch-Site", "Origin", "Referer"];
+function withCSRFVary(response) {
+  const current = response.headers.get("Vary");
+  if (current === "*") return response;
+  const values = current ? current.split(",").map(value => value.trim()) : [];
+  const names = new Set(values.map(value => value.toLowerCase()));
+  for (const value of CSRF_VARY) {
+    if (!names.has(value.toLowerCase())) values.push(value);
+  }
+  const vary = values.join(", ");
+  try {
+    response.headers.set("Vary", vary);
+    return response;
+  } catch {
+    const headers = new Headers(response.headers);
+    headers.set("Vary", vary);
+    return new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers
+    });
+  }
+}
+function forbiddenResponse() {
+  return withCSRFVary(new Response(DEV ? "Forbidden" : null, {
+    status: 403,
+    headers: {
+      "Cache-Control": "no-store"
+    }
+  }));
+}
 async function handleServerFunctionRequest(request, options = {}) {
   const codec = options.codec !== undefined ? options.codec : getServerFunctionsCodec();
   const url = new URL(request.url);
+  const csrf = options.csrf !== undefined ? options.csrf : config.csrf;
+  const protectsRequest = csrf !== false;
+  if (protectsRequest && !(await allowsServerFunctionRequest(request, csrf === true ? {} : csrf))) {
+    return forbiddenResponse();
+  }
   const instance = request.headers.get(INSTANCE_HEADER);
   const functionId = resolveFunctionId(request, url);
   if (!functionId) {
-    return new Response(DEV ? "Server function not found" : null, {
+    const response = new Response(DEV ? "Server function not found" : null, {
       status: 404
     });
+    return protectsRequest ? withCSRFVary(response) : response;
   }
   let serverFunction;
   try {
     serverFunction = getServerFunction(functionId);
   } catch {
-    return new Response(DEV ? `Unknown server function: ${functionId}` : null, {
+    const response = new Response(DEV ? `Unknown server function: ${functionId}` : null, {
       status: 404
     });
+    return protectsRequest ? withCSRFVary(response) : response;
   }
   if (request.method === "GET" && METHODS.get(functionId) !== "GET") {
-    return new Response(DEV ? `Method not allowed for server function: ${functionId}` : null, {
+    const response = new Response(DEV ? `Method not allowed for server function: ${functionId}` : null, {
       status: 405,
       headers: {
         Allow: "POST"
       }
     });
+    return protectsRequest ? withCSRFVary(response) : response;
   }
   const event = options.createEvent ? options.createEvent(request) : {
     request,
@@ -1131,7 +1200,8 @@ async function handleServerFunctionRequest(request, options = {}) {
       return encodeResult(safe, headers, 200, codec, request.signal);
     }
   };
-  return commitEventResponse(await dispatch(), event);
+  const response = commitEventResponse(await dispatch(), event);
+  return protectsRequest ? withCSRFVary(response) : response;
 }
 
-export { ERROR_HEADER, FLASH_COOKIE, FUNCTION_HEADER, GENERIC_SERVER_ERROR_MESSAGE, GET, INSTANCE_HEADER, SINGLE_FLIGHT_HEADER, clearFlashCookie, configureServerFunctionsServer, createNoJSHandler, createServerReference, decodeErrorHeaderValue, decodeFlashCookie, decodeResponse, decodeResponsePayload, encodeErrorHeaderValue, encodeFlashCookie, foldSetCookies, getEventServerFunctionInvocation, getServerFunction, getServerFunctionInvocation, getServerFunctionMetadata, handleServerFunctionRequest, hasFlashCookie, isServerFunction, live, registerServerFunction, registerServerReference, sanitizeServerError, serializeResponseStream, setServerFunctionsDev, subscribeFlightData, withMeta };
+export { ERROR_HEADER, FLASH_COOKIE, FUNCTION_HEADER, GENERIC_SERVER_ERROR_MESSAGE, GET, INSTANCE_HEADER, SINGLE_FLIGHT_HEADER, clearFlashCookie, configureServerFunctionsServer, createNoJSHandler, createServerReference, decodeErrorHeaderValue, decodeFlashCookie, decodeResponse, decodeResponsePayload, encodeErrorHeaderValue, encodeFlashCookie, foldSetCookies, getEventServerFunctionInvocation, getServerFunction, getServerFunctionInvocation, getServerFunctionMetadata, handleServerFunctionRequest, hasFlashCookie, isServerFunction, live, observeServerFunctionCalls, registerServerFunction, registerServerReference, sanitizeServerError, serializeResponseStream, setServerFunctionsDev, subscribeFlightData, withMeta };