@sveltejs/kit 3.0.0-next.2 → 3.0.0-next.21

package/src/runtime/server/cookie.js

@@ -1,4 +1,4 @@
-import { parse, serialize } from 'cookie';
+import { parseCookie, parseSetCookie, stringifySetCookie } from 'cookie';
 import { DEV } from 'esm-env';
 import { normalize_path, resolve } from '../../utils/url.js';
 import { add_data_suffix } from '../pathname.js';
@@ -12,10 +12,11 @@ import { text_encoder } from '../utils.js';
 const cookie_paths = {};
 
 /**
- * Cookies that are larger than this size (including the name and other
- * attributes) are discarded by browsers
+ * Cookies whose name and value combined are larger than this size are
+ * discarded by browsers. This is the limit codified for the name/value pair
+ * in RFC 6265bis: https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-20#section-5.6-7.5.1
  */
-const MAX_COOKIE_SIZE = 4129;
+const MAX_COOKIE_SIZE = 4096;
 
 /**
  * Generates a unique key for a cookie based on its domain, path, and name in
@@ -39,52 +40,68 @@ function generate_cookie_key(domain, path, name) {
 export function get_cookies(request, url) {
 	const header = request.headers.get('cookie') ?? '';
 	const initial_cookies = /** @type {Record<string, string>} */ (
-		parse(header, { decode: (value) => value })
+		parseCookie(header, { decode: (value) => value })
 	);
 
+	/** @type {ReturnType<typeof parseCookie> | undefined} */
+	let default_cookies;
+
+	/**
+	 * The header never changes during the request, so the default-decode parse is cached
+	 * @param {import('cookie').ParseOptions} [opts]
+	 */
+	function parse_header(opts) {
+		return opts?.decode ? parseCookie(header, opts) : (default_cookies ??= parseCookie(header));
+	}
+
+	/** @param {import('./page/types.js').Cookie} cookie */
+	function matches_url(cookie) {
+		return (
+			domain_matches(url.hostname, cookie.options.domain) &&
+			path_matches(url.pathname, cookie.options.path)
+		);
+	}
+
 	/** @type {string | undefined} */
 	let normalized_url;
 
 	/** @type {Map<string, import('./page/types.js').Cookie>} */
 	const new_cookies = new Map();
 
-	/** @type {import('cookie').SerializeOptions} */
+	/** @type {Omit<import('cookie').SetCookie, 'name' | 'value'>} */
 	const defaults = {
 		httpOnly: true,
 		path: '/',
 		sameSite: 'lax',
-		secure: url.hostname === 'localhost' && url.protocol === 'http:' ? false : true
+		secure: !__SVELTEKIT_DEV__ && !(url.hostname === 'localhost' && url.protocol === 'http:')
 	};
 
-	/** @type {import('@sveltejs/kit').Cookies} */
+	/** @type {import('$app/server').Cookies} */
 	const cookies = {
 		// The JSDoc param annotations appearing below for get, set and delete
 		// are necessary to expose the `cookie` library types to
-		// typescript users. `@type {import('@sveltejs/kit').Cookies}` above is not
+		// typescript users. `@type {import('$app/server').Cookies}` above is not
 		// sufficient to do so.
 
-		/**
-		 * @param {string} name
-		 * @param {import('cookie').ParseOptions} [opts]
-		 */
 		get(name, opts) {
 			// Look for the most specific matching cookie from new_cookies
-			const best_match = Array.from(new_cookies.values())
-				.filter((c) => {
-					return (
-						c.name === name &&
-						domain_matches(url.hostname, c.options.domain) &&
-						path_matches(url.pathname, c.options.path)
-					);
-				})
-				.sort((a, b) => b.options.path.length - a.options.path.length)[0];
+			/** @type {import('./page/types.js').Cookie | undefined} */
+			let best_match;
+			for (const c of new_cookies.values()) {
+				if (
+					c.name === name &&
+					matches_url(c) &&
+					(!best_match || c.options.path.length > best_match.options.path.length)
+				) {
+					best_match = c;
+				}
+			}
 
 			if (best_match) {
 				return best_match.options.maxAge === 0 ? undefined : best_match.value;
 			}
 
-			const req_cookies = parse(header, { decode: opts?.decode });
-			const cookie = req_cookies[name]; // the decoded string or undefined
+			const cookie = parse_header(opts)[name]; // the decoded string or undefined
 
 			// in development, if the cookie was set during this session with `cookies.set`,
 			// but at a different path, warn the user. (ignore cookies from request headers,
@@ -106,20 +123,15 @@ export function get_cookies(request, url) {
 			return cookie;
 		},
 
-		/**
-		 * @param {import('cookie').ParseOptions} [opts]
-		 */
 		getAll(opts) {
-			const cookies = parse(header, { decode: opts?.decode });
+			// copy, so the cached parse isn't mutated below
+			const cookies = { ...parse_header(opts) };
 
 			// Group cookies by name and find the most specific one for each name
 			const lookup = new Map();
 
 			for (const c of new_cookies.values()) {
-				if (
-					domain_matches(url.hostname, c.options.domain) &&
-					path_matches(url.pathname, c.options.path)
-				) {
+				if (matches_url(c)) {
 					const existing = lookup.get(c.name);
 
 					// If no existing cookie or this one has a more specific (longer) path, use this one
@@ -131,7 +143,13 @@ export function get_cookies(request, url) {
 
 			// Add the most specific cookies to the result
 			for (const c of lookup.values()) {
-				cookies[c.name] = c.value;
+				// tombstones (deleted cookies) shadow request-header cookies,
+				// mirroring the behavior of `get()`
+				if (c.options.maxAge === 0) {
+					delete cookies[c.name];
+				} else {
+					cookies[c.name] = c.value;
+				}
 			}
 
 			return /** @type {Array<{ name: string; value: string }>} */ (
@@ -141,29 +159,17 @@ export function get_cookies(request, url) {
 			);
 		},
 
-		/**
-		 * @param {string} name
-		 * @param {string} value
-		 * @param {import('cookie').SerializeOptions} options
-		 */
 		set(name, value, options) {
 			set_internal(name, value, { ...defaults, ...options });
 		},
 
-		/**
-		 * @param {string} name
-		 * @param {import('cookie').SerializeOptions} options
-		 */
 		delete(name, options) {
 			cookies.set(name, '', { ...options, maxAge: 0 });
 		},
 
-		/**
-		 * @param {string} name
-		 * @param {string} value
-		 * @param {import('cookie').SerializeOptions} options
-		 */
-		serialize(name, value, options) {
+		parse: parseSetCookie,
+
+		serialize(name, value, { encode, ...options }) {
 			let path = options.path ?? '/';
 
 			if (!options.domain || options.domain === url.hostname) {
@@ -173,7 +179,7 @@ export function get_cookies(request, url) {
 				path = resolve(normalized_url, path);
 			}
 
-			return serialize(name, value, { ...defaults, ...options, path });
+			return stringifySetCookie({ name, value, ...defaults, ...options, path }, { encode });
 		}
 	};
 
@@ -200,7 +206,7 @@ export function get_cookies(request, url) {
 		// explicit header has highest precedence
 		if (header) {
 			const parsed = /** @type {Record<string, string>} */ (
-				parse(header, { decode: (value) => value })
+				parseCookie(header, { decode: (value) => value })
 			);
 			for (const name in parsed) {
 				combined_cookies[name] = parsed[name];
@@ -238,8 +244,12 @@ export function get_cookies(request, url) {
 		new_cookies.set(cookie_key, cookie);
 
 		if (DEV) {
-			const serialized = serialize(name, value, cookie.options);
-			if (text_encoder.encode(serialized).byteLength > MAX_COOKIE_SIZE) {
+			const size =
+				// only the name/value pair counts towards MAX_COOKIE_SIZE, not the other attributes
+				text_encoder.encode(name).byteLength +
+				text_encoder.encode((options.encode ?? encodeURIComponent)(value)).byteLength;
+
+			if (size > MAX_COOKIE_SIZE) {
 				throw new Error(`Cookie "${name}" is too large, and will be discarded by the browser`);
 			}
 
@@ -296,15 +306,22 @@ export function path_matches(path, constraint) {
  */
 export function add_cookies_to_headers(headers, cookies) {
 	for (const new_cookie of cookies) {
-		const { name, value, options } = new_cookie;
-		headers.append('set-cookie', serialize(name, value, options));
+		const {
+			name,
+			value,
+			options: { encode, ...options }
+		} = new_cookie;
+		headers.append('set-cookie', stringifySetCookie({ name, value, ...options }, { encode }));
 
 		// special case — for routes ending with .html, the route data lives in a sibling
 		// `.html__data.json` file rather than a child `/__data.json` file, which means
 		// we need to duplicate the cookie
 		if (options.path.endsWith('.html')) {
 			const path = add_data_suffix(options.path);
-			headers.append('set-cookie', serialize(name, value, { ...options, path }));
+			headers.append(
+				'set-cookie',
+				stringifySetCookie({ name, value, ...options, path }, { encode })
+			);
 		}
 	}
 }

package/src/runtime/server/csrf.js

@@ -0,0 +1,65 @@
+import { is_form_content_type } from '../../utils/http.js';
+
+const mutating_form_methods = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
+
+/**
+ * The origin SvelteKit treats as "self" when validating the `Origin` header on
+ * cross-site requests.
+ *
+ * By default (`paths.origin` is `undefined`), SvelteKit derives the origin
+ * from `request.url` (which is set by the adapter, and ultimately by the
+ * platform). When `paths.origin` is configured — for example so that a preview
+ * deployment whose URL isn't known at build time, or an app behind a reverse
+ * proxy, can declare a canonical origin — that value takes precedence.
+ *
+ * @param {string | undefined} paths_origin the configured `kit.paths.origin`
+ * @param {string} url_origin the origin derived from `request.url`
+ * @returns {string}
+ */
+export function get_self_origin(paths_origin, url_origin) {
+	return paths_origin || url_origin;
+}
+
+/**
+ * Determines whether a non-remote request should be rejected as a cross-site
+ * request forgery (CSRF). Used by `respond.js` to gate form `POST`/`PUT`/
+ * `PATCH`/`DELETE` requests whose `Origin` header doesn't match the app's
+ * self-origin (and isn't in `trusted_origins`).
+ *
+ * @param {{
+ *   request: Request;
+ *   request_origin: string | null;
+ *   self_origin: string;
+ *   trusted_origins: string[];
+ * }} input
+ * @returns {boolean}
+ */
+export function is_csrf_forbidden({ request, request_origin, self_origin, trusted_origins }) {
+	return (
+		(!request.headers.get('content-type') || is_form_content_type(request)) &&
+		mutating_form_methods.has(request.method) &&
+		request_origin !== self_origin &&
+		(!request_origin || !trusted_origins.includes(request_origin))
+	);
+}
+
+/**
+ * Determines whether a remote-function request should be rejected as cross-site.
+ *
+ * Unlike form submissions, remote functions accept any content type (e.g.
+ * `application/json`), so the check is solely on the request method and origin:
+ * a non-`GET` request is forbidden when its `Origin` header doesn't match the
+ * app's self-origin. Unlike `is_csrf_forbidden`, entries in `trusted_origins`
+ * are *not* honoured — remote function endpoints are an implementation detail,
+ * not a public API, so cross-origin calls are forbidden regardless.
+ *
+ * @param {{
+ *   request: Request;
+ *   request_origin: string | null;
+ *   self_origin: string;
+ * }} input
+ * @returns {boolean}
+ */
+export function is_remote_forbidden({ request, request_origin, self_origin }) {
+	return request.method !== 'GET' && request_origin !== self_origin;
+}

package/src/runtime/server/data/index.js

@@ -1,39 +1,36 @@
 import { text } from '@sveltejs/kit';
-import { HttpError, SvelteKitError, Redirect } from '@sveltejs/kit/internal';
+import { Redirect } from '@sveltejs/kit/internal';
 import { normalize_error } from '../../../utils/error.js';
 import { once } from '../../../utils/functions.js';
 import { server_data_serializer_json } from '../page/data_serializer.js';
 import { load_server_data } from '../page/load_data.js';
-import { handle_error_and_jsonify } from '../utils.js';
+import { handle_error_and_jsonify } from '../errors.js';
 import { normalize_path } from '../../../utils/url.js';
 import { text_encoder } from '../../utils.js';
+import { with_version_header } from '../utils.js';
 
 /**
- * @param {import('@sveltejs/kit').RequestEvent} event
- * @param {import('types').RequestState} event_state
+ * @param {import('$app/server').RequestEvent} event
+ * @param {import('types').RequestState} state
  * @param {import('types').SSRRoute} route
  * @param {import('types').SSROptions} options
  * @param {import('@sveltejs/kit').SSRManifest} manifest
- * @param {import('types').SSRState} state
  * @param {boolean[] | undefined} invalidated_data_nodes
  * @param {import('types').TrailingSlash} trailing_slash
  * @returns {Promise<Response>}
  */
 export async function render_data(
 	event,
-	event_state,
+	state,
 	route,
 	options,
 	manifest,
-	state,
 	invalidated_data_nodes,
 	trailing_slash
 ) {
 	if (!route.page) {
 		// requesting /__data.json should fail for a +server.js
-		return new Response(undefined, {
-			status: 404
-		});
+		return with_version_header(new Response(undefined, { status: 404 }));
 	}
 
 	try {
@@ -61,7 +58,6 @@ export async function render_data(
 					// load this. for the child, return as is. for the final result, stream things
 					return load_server_data({
 						event: new_event,
-						event_state,
 						state,
 						node,
 						parent: async () => {
@@ -96,31 +92,25 @@ export async function render_data(
 			return fn();
 		});
 
-		let length = promises.length;
-		const nodes = await Promise.all(
-			promises.map((p, i) =>
-				p.catch(async (error) => {
+		const data_serializer = server_data_serializer_json(event, state, options);
+		await Promise.all(
+			promises.map(async (p, i) => {
+				const node = await p.catch(async (error) => {
 					if (error instanceof Redirect) {
 						throw error;
 					}
 
-					// Math.min because array isn't guaranteed to resolve in order
-					length = Math.min(length, i + 1);
+					const transformed = await handle_error_and_jsonify(event, state, options, error);
 
 					return /** @type {import('types').ServerErrorNode} */ ({
 						type: 'error',
-						error: await handle_error_and_jsonify(event, event_state, options, error),
-						status:
-							error instanceof HttpError || error instanceof SvelteKitError
-								? error.status
-								: undefined
+						error: transformed
 					});
-				})
-			)
-		);
+				});
 
-		const data_serializer = server_data_serializer_json(event, event_state, options);
-		for (let i = 0; i < nodes.length; i++) data_serializer.add_node(i, nodes[i]);
+				data_serializer.add_node(i, node);
+			})
+		);
 		const { data, chunks } = data_serializer.get_data();
 
 		if (!chunks) {
@@ -129,26 +119,28 @@ export async function render_data(
 			return json_response(data);
 		}
 
-		return new Response(
-			new ReadableStream({
-				async start(controller) {
-					controller.enqueue(text_encoder.encode(data));
-					for await (const chunk of chunks) {
-						controller.enqueue(text_encoder.encode(chunk));
+		return with_version_header(
+			new Response(
+				new ReadableStream({
+					async start(controller) {
+						controller.enqueue(text_encoder.encode(data));
+						for await (const chunk of chunks) {
+							controller.enqueue(text_encoder.encode(chunk));
+						}
+						controller.close();
+					},
+
+					type: 'bytes'
+				}),
+				{
+					headers: {
+						// we use a proprietary content type to prevent buffering.
+						// the `text` prefix makes it inspectable
+						'content-type': 'text/sveltekit-data',
+						'cache-control': 'private, no-store'
 					}
-					controller.close();
-				},
-
-				type: 'bytes'
-			}),
-			{
-				headers: {
-					// we use a proprietary content type to prevent buffering.
-					// the `text` prefix makes it inspectable
-					'content-type': 'text/sveltekit-data',
-					'cache-control': 'private, no-store'
 				}
-			}
+			)
 		);
 	} catch (e) {
 		const error = normalize_error(e);
@@ -156,7 +148,8 @@ export async function render_data(
 		if (error instanceof Redirect) {
 			return redirect_json_response(error);
 		} else {
-			return json_response(await handle_error_and_jsonify(event, event_state, options, error), 500);
+			const transformed = await handle_error_and_jsonify(event, state, options, error);
+			return json_response(transformed, transformed.status);
 		}
 	}
 }
@@ -166,13 +159,15 @@ export async function render_data(
  * @param {number} [status]
  */
 function json_response(json, status = 200) {
-	return text(typeof json === 'string' ? json : JSON.stringify(json), {
-		status,
-		headers: {
-			'content-type': 'application/json',
-			'cache-control': 'private, no-store'
-		}
-	});
+	return with_version_header(
+		text(typeof json === 'string' ? json : JSON.stringify(json), {
+			status,
+			headers: {
+				'content-type': 'application/json',
+				'cache-control': 'private, no-store'
+			}
+		})
+	);
 }
 
 /**
@@ -182,6 +177,7 @@ export function redirect_json_response(redirect) {
 	return json_response(
 		/** @type {import('types').ServerRedirectNode} */ ({
 			type: 'redirect',
+			status: redirect.status,
 			location: redirect.location
 		})
 	);

package/src/runtime/server/dev.js

@@ -0,0 +1,22 @@
+const symbol = Symbol.for('sveltekit.global_state');
+const state = /** @type {Record<symbol, any>} */ (
+	/** @type {Record<symbol, unknown>} */ (/** @type {unknown} */ (globalThis))[symbol] ??= {}
+);
+
+/**
+ * Persist a value across dev server reloads, in case a freshly-invalidated module
+ * reads global state that is not set until a request is handled
+ * @param {symbol} key
+ * @param {any} value
+ */
+export function save(key, value) {
+	state[key] = value;
+}
+
+/**
+ * Restore a value after a dev server reload
+ * @param {symbol} key
+ */
+export function restore(key) {
+	return state[key];
+}

package/src/runtime/server/endpoint.js

@@ -5,13 +5,12 @@ import { negotiate } from '../../utils/http.js';
 import { method_not_allowed } from './utils.js';
 
 /**
- * @param {import('@sveltejs/kit').RequestEvent} event
- * @param {import('types').RequestState} event_state
+ * @param {import('$app/server').RequestEvent} event
+ * @param {import('types').RequestState} state
  * @param {import('types').SSREndpoint} mod
- * @param {import('types').SSRState} state
  * @returns {Promise<Response>}
  */
-export async function render_endpoint(event, event_state, mod, state) {
+export async function render_endpoint(event, state, mod) {
 	const method = /** @type {import('types').HttpMethod} */ (event.request.method);
 
 	let handler = mod[method] || mod.fallback;
@@ -42,8 +41,8 @@ export async function render_endpoint(event, event_state, mod, state) {
 	}
 
 	try {
-		const response = await with_request_store({ event, state: event_state }, () =>
-			handler(/** @type {import('@sveltejs/kit').RequestEvent<Record<string, any>>} */ (event))
+		const response = await with_request_store({ event, state }, () =>
+			handler(/** @type {import('$app/server').RequestEvent<Record<string, any>>} */ (event))
 		);
 
 		if (!(response instanceof Response)) {
@@ -90,7 +89,7 @@ export async function render_endpoint(event, event_state, mod, state) {
 }
 
 /**
- * @param {import('@sveltejs/kit').RequestEvent} event
+ * @param {import('$app/server').RequestEvent} event
  */
 export function is_endpoint_request(event) {
 	const { method, headers } = event.request;

package/src/runtime/server/env_module.js

@@ -16,7 +16,6 @@ let headers;
  */
 export function get_public_env(request) {
 	const env = rendered_env;
-	const script = request.url.endsWith('.script.js');
 
 	payload ??= devalue.uneval(env);
 	etag ??= `W/${Date.now()}`;
@@ -29,9 +28,5 @@ export function get_public_env(request) {
 		return new Response(undefined, { status: 304, headers });
 	}
 
-	if (script) {
-		return new Response(`globalThis.__sveltekit_sw={env:${payload}}`, { headers });
-	}
-
 	return new Response(`export const env=${payload}`, { headers });
 }