@webjsdev/server 0.8.57 → 0.8.59

package/src/actions.js

@@ -20,6 +20,7 @@ import { ifNoneMatchSatisfied } from './conditional-get.js';
 import { getBodyLimits } from './context.js';
 import { basePath } from './importmap.js';
 import { withBasePath } from './base-path.js';
+import { FORM_ACTION_ID_KEY } from '@webjsdev/core';
 
 /**
  * The JSON / RPC body cap in effect for the current request: the per-request
@@ -417,11 +418,18 @@ function buildStubBody({ hash, method, fnNames, actionUrl }) {
     lines.push(`  return __body(fn, key, __METHOD, sig);`);
     lines.push(`}`);
   }
+  // Each stub carries its own `<hash>/<fn>` identity (#1155), so a client
+  // re-render of `<form action=${action}>` can bind the live form
+  // synchronously. The server resolves the REAL function's identity through the
+  // load-hook registry instead; both produce the same string, which is what
+  // makes the SSR'd form and the re-rendered one submit the same value.
+  // Non-enumerable so `import * as actions` and a spread stay unchanged.
+  lines.push(`const __id = (fn, name) => { try { Object.defineProperty(fn, ${J(FORM_ACTION_ID_KEY)}, { value: __HASH + '/' + name }); } catch {} return fn; };`);
   for (const name of fnNames) {
     lines.push(
       name === 'default'
-        ? `export default (...args) => __call('default', args);`
-        : `export const ${name} = (...args) => __call(${J(name)}, args);`,
+        ? `export default __id((...args) => __call('default', args), 'default');`
+        : `export const ${name} = __id((...args) => __call(${J(name)}, args), ${J(name)});`,
     );
   }
   return lines.join('\n') + '\n';
@@ -563,8 +571,10 @@ export async function invokeAction(idx, hash, fnName, req, onError, allowedOrigi
  * Build a GET action's response (#488): the serialized body plus a weak ETag
  * (content hash), the `Cache-Control` from the `cache` config (else `no-store`),
  * and `X-Webjs-Tags`. Answers `If-None-Match` with a 304 itself rather than
- * relying on the conditional-GET funnel, which EXCLUDES `private` responses (the
- * default here); a per-user browser cache may still revalidate to a 304.
+ * deferring to the conditional-GET funnel: this branch already hashed the
+ * serialized body, so it can answer without the funnel re-reading it. (The
+ * funnel would now accept these too, since #1140 stopped excluding `private`,
+ * but the short-circuit here still runs first and is cheaper.)
  * @param {unknown} result
  * @param {Record<string, unknown>} mod
  * @param {unknown[]} args

package/src/asset-hash.js

@@ -159,10 +159,32 @@ export function assetHashFor(absPath) {
     const bytes = readFileSync(absPath);
     const h = createHash('sha256').update(bytes);
     // An app module's served body is elision-transformed, so fold the verdict
-    // fingerprint in (see `_elisionFp`). Core / public files are never
-    // transformed, so they hash over their bytes alone. Empty fp leaves an app
-    // module's hash at exactly `sha256(bytes)`.
-    if (_elisionFp && _appDir && absPath.startsWith(_appDir + sep)) {
+    // fingerprint in (see `_elisionFp`). Core and `public/` files are never
+    // transformed, so they hash over their bytes alone, which the two
+    // exclusions below enforce rather than merely assume. Empty fp leaves an
+    // app module's hash at exactly `sha256(bytes)`.
+    //
+    // Both exclusions are EXPLICIT because the containment test alone admits
+    // them, and the intent above is otherwise silently false:
+    //
+    //   - `public/` sits under `_appDir`. Inert while only module specifiers
+    //     reached here, but `asset()` (#1194) routes public paths through this
+    //     function.
+    //   - `_coreDir` sits under `_appDir` too in a REAL install, where it
+    //     resolves to `<appDir>/node_modules/@webjsdev/core`. It escapes only
+    //     in this monorepo, where the workspace symlink lands outside, which
+    //     is exactly why no in-repo test ever caught it.
+    //
+    // Neither file set is elision-transformed (core is served verbatim by
+    // `fileResponse`), so folding the verdict in buys nothing and costs
+    // correctness: any deploy that merely flips an UNRELATED component between
+    // elidable and interactive would move their urls, re-downloading the whole
+    // core runtime plus every marked stylesheet, image, and script even though
+    // not one of those bytes changed. That is the precise cost a content hash
+    // exists to avoid.
+    if (_elisionFp && _appDir && absPath.startsWith(_appDir + sep)
+        && !absPath.startsWith(join(_appDir, 'public') + sep)
+        && !(_coreDir && absPath.startsWith(_coreDir + sep))) {
       h.update('\0');
       h.update(_elisionFp);
     }
@@ -267,6 +289,46 @@ export function withAssetHash(url, basePath = '') {
   return `${url}${sepChar}v=${hash}`;
 }
 
+/**
+ * Resolve one author-marked asset path to its fingerprinted url. This is the
+ * body behind the isomorphic `asset()` helper (#1194); `dev.js` installs it
+ * via `setAssetUrlProvider` at boot.
+ *
+ * The `public/` gate is defensive, not decorative. `resolveUrlToFile` maps any
+ * same-origin path under the PROJECT ROOT, so an app that passed request- or
+ * user-derived data in (`asset(user.avatarPath)`) would otherwise read and
+ * publish a content hash for `/.env`, `/db/app.db`, or a `.server.ts`, leaking
+ * both that the file exists and a fingerprint of its exact bytes for files the
+ * serve path deliberately 404s. Mirror the static-asset route instead: under
+ * `public/`, no traversal. Anything else returns unchanged WITHOUT touching
+ * the disk, so a rejected path costs nothing and reveals nothing.
+ *
+ * A fragment is split before hashing. `withAssetHash` appends the query, so
+ * passing the whole thing would emit `/x.svg#icon?v=H`: the browser then
+ * requests `/x.svg` with no query (losing the immutable caching this exists
+ * for) and the fragment becomes `icon?v=H`, matching no element id.
+ *
+ * @param {string} p          the author-supplied path
+ * @param {string} [bp]       the active base path
+ * @returns {string}          the fingerprinted url, or `p` unchanged
+ */
+export function resolveAssetUrl(p, bp = '') {
+  if (typeof p !== 'string' || p[0] !== '/' || p[1] === '/') return p;
+  let probe = p;
+  if (bp && probe.startsWith(bp + '/')) probe = probe.slice(bp.length);
+  const cuts = [probe.indexOf('?'), probe.indexOf('#')].filter((i) => i !== -1);
+  let decoded = probe.slice(0, cuts.length ? Math.min(...cuts) : probe.length);
+  try { decoded = decodeURIComponent(decoded); } catch { /* keep raw */ }
+  if (decoded.includes('..') || !decoded.startsWith('/public/')) return p;
+  const h = p.indexOf('#');
+  const path = h === -1 ? p : p.slice(0, h);
+  const frag = h === -1 ? '' : p.slice(h);
+  // An author-supplied query is left alone: it may carry meaning we do not
+  // own, and appending would merge with `&`.
+  if (path.includes('?')) return p;
+  return withAssetHash(path, bp) + frag;
+}
+
 /**
  * Static `import` specifier with positional indices. Mirrors module-graph.js's
  * `IMPORT_RE` (side-effect / default / namespace / named imports), but captures

package/src/base-path.js

@@ -11,7 +11,10 @@
  * hydrates. `createRequestHandler` explicitly targets embedding, where a
  * sub-path mount is the norm.
  *
- * The model is strip-at-ingress + prefix-on-emit, two seams only:
+ * The model is strip-at-ingress + prefix-on-emit. Two seams carry it, plus two
+ * further `stripBasePath` consumers on the CACHE path (`dev.js`'s HTML-cache
+ * write and `html-cache.js`'s `revalidatePath`), which key on the
+ * app-root-relative path so a mounted app hits its own cache:
  *
  *   1. STRIP AT INGRESS. At the very start of request handling, when the
  *      request pathname starts with the basePath, strip it so all

package/src/body-limit.js

@@ -3,7 +3,7 @@
  *
  * webjs's prod server reads request bodies on three paths: the server-action
  * RPC endpoint (actions.js), `route.{js,ts}` handlers via `readBody` (json.js),
- * and the no-JS page-action form path (page-action.js). Without a cap, an
+ * and the no-JS form-submission path (form-dispatch.js). Without a cap, an
  * uncapped body is a memory-exhaustion vector. This module is the SINGLE place
  * that decides the limit and performs a bounded read, so every body-read site
  * enforces it uniformly.
@@ -31,7 +31,7 @@
 export const DEFAULT_MAX_BODY_BYTES = 1024 * 1024;
 
 /**
- * Default form / multipart body cap: 10 MiB. A form submission (the page-action
+ * Default form / multipart body cap: 10 MiB. A form submission (the form-dispatch
  * path) may legitimately carry more than a JSON RPC call (a textarea, a small
  * upload), so it gets a separate, higher, still-bounded limit. Large file
  * uploads are a distinct concern (#247) with their own streaming story.
@@ -40,7 +40,7 @@ export const DEFAULT_MAX_MULTIPART_BYTES = 10 * 1024 * 1024;
 
 /**
  * Thrown by `readBody` (json.js) when a route handler's body exceeds the limit.
- * The RPC and page-action paths return a 413 Response inline, but `readBody`
+ * The RPC and form-dispatch paths return a 413 Response inline, but `readBody`
  * runs INSIDE a user route handler and returns parsed data, so it signals the
  * over-limit case by throwing. The API dispatcher (`handleApi`) catches this and
  * maps it to a 413, so a handler that just does `await readBody(req)` gets the
@@ -266,7 +266,7 @@ export async function readTextBounded(req, limit) {
 }
 
 /**
- * Read a request body as `FormData`, bounded by `limit`. Used by the page-action
+ * Read a request body as `FormData`, bounded by `limit`. Used by the form-dispatch
  * form path. Reconstructs a bounded Request from the already-read bytes and
  * defers to the platform `formData()` parser, so multipart and
  * urlencoded bodies are decoded exactly as before, just size-checked first.

package/src/check.js

@@ -3,6 +3,7 @@ import { join, relative, sep, basename, dirname } from 'node:path';
 import { walk } from './fs-walk.js';
 import {
   redactStringsAndTemplates,
+  redactToPlaceholders,
   extractWebComponentClassBodies,
   matchClosingBrace,
   parsePropEntries,
@@ -134,6 +135,11 @@ export const RULES = [
     description:
       'A `\'use server\'` action file that declares HTTP-verb config (any of `method` / `cache` / `tags` / `invalidates` / `validate`, #488) must export exactly ONE callable action function. The config is file-level (it applies to the action in the file), so a second exported function would silently inherit the same verb / cache, which is almost never intended and makes the contract ambiguous. Move the extra function to its own `.server.ts` file (the one-function-per-file convention), or, if it is a private helper, do not export it. Files with no verb config are unaffected.',
   },
+  {
+    name: 'form-action-not-a-get-action',
+    description:
+      'Flags `<form action=${someAction}>` bound to a `\'use server\'` action whose file declares `export const method = \'GET\'` (#488). A GET action is a READ: it is CSRF-exempt and rides its arguments in the url, while a form submission is a CSRF-checked POST carrying a body, so the two contracts contradict each other and the submission is answered with a 405 at runtime. The rule reads the imported action\'s own file, so it only fires when the binding really does resolve to a GET-declared action. Fix by dropping the `method` export (an action with no `method` is a POST, which is what a form wants) or by binding a different action; if the form really is a read, use a plain `<form method="get" action="/search">` with no bound action.',
+  },
   {
     name: 'no-redirect-in-api-route',
     description:
@@ -475,6 +481,36 @@ function enumerableExports(scan) {
  * @param {string} clause  the text between `import` and `from`
  * @returns {string[]|null}
  */
+/**
+ * The `{ local, imported }` pairs a named import clause binds, for a rule that
+ * has to match the LOCAL name against code (`action=${reader}`) while reporting
+ * the IMPORTED one (`readIt`, which is what the target module calls it).
+ *
+ * `importedValueNames` cannot serve here: it returns only the imported side,
+ * which is the wrong name to match against a template hole under `as`.
+ *
+ * @param {string} clause  the text between `import` and `from`
+ * @returns {{ local: string, imported: string }[]}
+ */
+function importedLocalNames(clause) {
+  if (/^\s*type\b/.test(clause)) return [];
+  const brace = clause.match(/\{([^}]*)\}/);
+  if (!brace) return [];
+  /** @type {{ local: string, imported: string }[]} */
+  const out = [];
+  for (const part of brace[1].split(',')) {
+    const seg = part.trim().replace(/^type\s+/, '');
+    if (!seg) continue;
+    const as = seg.split(/\s+as\s+/);
+    const imported = as[0].trim();
+    const local = (as[1] || as[0]).trim();
+    if (/^[A-Za-z_$][\w$]*$/.test(local) && /^[A-Za-z_$][\w$]*$/.test(imported)) {
+      out.push({ local, imported });
+    }
+  }
+  return out;
+}
+
 function importedValueNames(clause) {
   if (/^\s*type\b/.test(clause)) return null; // import type { ... }
   const brace = clause.match(/\{([^}]*)\}/);
@@ -489,8 +525,9 @@ function importedValueNames(clause) {
 /**
  * Scan a WebJs app directory and report convention violations.
  *
- * Every rule is a correctness check (a crash, a security leak, or a
- * build/type-strip failure), so they all run unconditionally. There is no
+ * Every rule is a correctness check (a crash, a security leak, a reactive
+ * prop that silently stops re-rendering, or a build/type-strip failure), so
+ * they all run unconditionally. There is no
  * per-project disabling: project conventions (layout, style, process) live in
  * CONVENTIONS.md as guidance, not in this tool.
  *
@@ -1333,6 +1370,90 @@ export async function checkConventions(appDir) {
     }
   }
 
+  // --- Rule: form-action-not-a-get-action (#1155) ---
+  // `<form action=${fn}>` binds a server action to a POST submission. An action
+  // declaring `method = 'GET'` cannot serve one: it is CSRF-exempt and takes its
+  // args in the url, so the dispatcher answers 405. Catch it at edit time.
+  {
+    // A `'use server'` file's declared method, or absent when it declares none.
+    const methodByAbs = new Map();
+    for (const f of files) {
+      if (!/\.server\.m?[jt]s$/.test(f.rel)) continue;
+      if (!hasUseServerDirective(f.content)) continue;
+      const m = /\bexport\s+const\s+method\s*(?::[^=]*)?=\s*['"`]([A-Za-z]+)['"`]/.exec(f.scan);
+      if (m) methodByAbs.set(f.abs, m[1].toUpperCase());
+    }
+    if (methodByAbs.size) {
+      const reImport = /\bimport\s+([^'";]*?)\bfrom\s*(['"])/g;
+      for (const { abs, rel, content } of files) {
+        // PLACEHOLDER redaction, not either mask, and the choice is forced.
+        // The default mask blanks a tagged template outright, so a real
+        // `html`<form action=${fn}>`` disappears and the rule could never fire;
+        // the fully-blanked mask does the same. Placeholder mode keeps `${...}`
+        // holes as REAL code while turning each literal BODY into one opaque
+        // `__STR_n__` token, so a live binding is readable and a `<form
+        // action=${x}>` shown as text inside a docs sample is a single token
+        // with no hole in it. That distinction is the whole carve-out: the
+        // framework's own website renders this exact shape as a code sample.
+        const { redacted, literals } = redactToPlaceholders(content);
+        // A hole binds an action when the literal segment IMMEDIATELY before it
+        // ends inside a start tag at the attribute that tag can really bind:
+        // `action=` on a `<form>` (#1155), or `formaction=` on a `<button>` /
+        // `<input>` submitter (#1207). Reading the segment rather than the whole
+        // template is what keeps `<div action=${x}>` out. The tag and the
+        // attribute are matched as a PAIR, so `<form formaction=${x}>` and
+        // `<button action=${x}>` stay out too: both are refused at render time,
+        // and neither is this rule's failure mode.
+        const bound = new Set();
+        for (const m of redacted.matchAll(/__STR_(\d+)__\$\{\s*([A-Za-z_$][\w$]*)\s*\}/g)) {
+          const before = literals[Number(m[1])] || '';
+          // The last `<` opens the tag the hole sits in. Requiring no `>`
+          // after it keeps the match inside that one start tag.
+          const tagAt = before.lastIndexOf('<');
+          if (tagAt < 0) continue;
+          const tag = before.slice(tagAt);
+          if (tag.includes('>')) continue;
+          const bindsForm = /^<form\b/i.test(tag) && /\saction=$/i.test(tag);
+          const bindsSubmitter = /^<(?:button|input)\b/i.test(tag) && /\sformaction=$/i.test(tag);
+          if (!bindsForm && !bindsSubmitter) continue;
+          bound.add(m[2]);
+        }
+        if (!bound.size) continue;
+        reImport.lastIndex = 0;
+        let im;
+        while ((im = reImport.exec(redacted))) {
+          // The specifier is a placeholder token in this view, so read the real
+          // one back out of `literals`.
+          const tok = /__STR_(\d+)__/.exec(redacted.slice(reImport.lastIndex, reImport.lastIndex + 24));
+          if (!tok) continue;
+          const spec = literals[Number(tok[1])] || '';
+          if (!/^(?:\.|#)/.test(spec)) continue;
+          const names = importedLocalNames(im[1]);
+          if (!names.length) continue;
+          const target = resolveImport(spec, abs, appDir);
+          // ONLY a GET is contradictory, and the rule must say exactly what the
+          // dispatcher does or it is a false positive. A browser form always
+          // submits as a POST, and the dispatcher runs a PUT / PATCH / DELETE
+          // action on that POST: the declared verb governs the RPC transport,
+          // not whether the function can serve a form. A GET is different in
+          // kind (CSRF-exempt, args in the url, no body), which is why it is
+          // the one the dispatcher answers with a 405.
+          const method = target ? methodByAbs.get(target) : undefined;
+          if (method !== 'GET') continue;
+          for (const { local, imported } of names) {
+            if (!bound.has(local)) continue;
+            violations.push({
+              rule: 'form-action-not-a-get-action',
+              file: rel,
+              message: `Binds \`${imported}\` to a form, but \`${spec}\` declares \`method = 'GET'\`. A GET action rides its arguments in the url and skips the CSRF check, so it cannot answer a form POST; the submission is a 405.`,
+              fix: `Drop the \`method\` export from \`${spec}\` (an action with no method is a POST, which is what a form submits), or bind an action that takes a POST.`,
+            });
+          }
+        }
+      }
+    }
+  }
+
   return violations;
 }
 

package/src/conditional-get.js

@@ -10,9 +10,15 @@
  * uniformly.
  *
  * What is EXCLUDED, and why:
- *   - `no-store` / `private` responses (the default for dynamic, per-user
- *     pages). Never enable a cross-session 304 on private content: a shared
- *     cache keyed on the URL could serve one user's validator to another.
+ *   - `no-store` responses (the default for a dynamic page), which forbid
+ *     storage outright, so there is nothing to validate. `private` is NOT
+ *     excluded: it forbids SHARED storage, not validation, and the ETag hashes
+ *     THIS response's body, so two users with different bodies get different
+ *     ETags and neither can match the other's, while two users with identical
+ *     bodies are asking about identical bytes, where a 304 discloses nothing
+ *     (#1140).
+ *     That is what lets the client router's partial responses stay `private`
+ *     without losing their 304s.
  *   - Any body the framework did not positively mark as fully buffered. The
  *     funnel only hashes a response that ALREADY carries an `ETag` (a serve
  *     branch hashed its own bytes) OR carries the internal `X-Webjs-Buffered`
@@ -77,11 +83,28 @@ const STRIP_ON_304 = ['content-length', 'content-encoding', 'content-type'];
 
 /**
  * Is this response cacheable enough to carry a validator?  Cacheable means a
- * 200 whose `Cache-Control` is present and does not forbid storage. A
- * `no-store` or `private` response is excluded (private / per-user content
- * must never get a cross-session 304). `no-cache` is INCLUDED: it means
- * "revalidate before reuse", and a 304 is exactly that revalidation answer,
- * so dev's `no-cache` assets still benefit.
+ * 200 whose `Cache-Control` is present and does not forbid STORAGE. Only
+ * `no-store` is excluded. `no-cache` is INCLUDED: it means "revalidate before
+ * reuse", and a 304 is exactly that revalidation answer, so dev's `no-cache`
+ * assets still benefit.
+ *
+ * `private` is INCLUDED too (#1140). It was excluded on the theory that
+ * per-user content must never get a "cross-session" 304, but that cannot
+ * happen: the ETag is a hash of THIS response's body, and a 304 is returned
+ * only when the client's own `If-None-Match` matches it. Two users with
+ * different bodies get different ETags, so neither can ever match the other's;
+ * two users with identical bodies are asking about identical bytes, where a
+ * 304 is the correct answer and carries no body either way. `private` already
+ * forbids the one real hazard, a SHARED cache storing the response.
+ *
+ * Widening this is what makes #1140's fragment downgrade safe to ship. Before
+ * that change a reduced fragment INHERITED the page's public header, so it
+ * already passed this check and already carried a validator; marking fragments
+ * `private` would have taken that away, and since the router fetches them with
+ * `cache: 'no-cache'` (#1131), every prefetch and soft navigation would have
+ * re-downloaded the whole fragment. The exclusion is dropped rather than
+ * special-cased because it was never justified on its own terms either, per
+ * the reasoning above.
  *
  * @param {Response} res
  * @returns {boolean}
@@ -90,7 +113,7 @@ function isCacheable(res) {
   if (res.status !== 200) return false;
   const cc = res.headers.get('cache-control');
   if (!cc) return false;
-  return !/(?:^|,)\s*(?:no-store|private)\s*(?:,|$)/i.test(cc);
+  return !/(?:^|,)\s*no-store\s*(?:,|$)/i.test(cc);
 }
 
 /**

package/src/context.js

@@ -17,7 +17,7 @@ import { setCspNonceProvider, cspNonce } from '@webjsdev/core';
  *
  * `bodyLimits` holds the resolved request body-size caps (issue #237) so
  * `readBody` (used inside `route.{js,ts}` handlers, which have no handle to the
- * server state) can enforce the same limit the RPC and page-action paths do. The
+ * server state) can enforce the same limit the RPC and form-dispatch paths do. The
  * handler writes it per request via `setBodyLimits`.
  *
  * `requestId` holds the per-request correlation id (issue #239). The handler

package/src/csp.js

@@ -50,8 +50,9 @@ const CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/;
  * with webjs's own output, which is: nonce-signed inline `<script>` tags
  * (the boot script, the public-env shim, the importmap), nonce-signed
  * `<link rel="modulepreload">`, ES modules fetched same-origin and from
- * the configured vendor CDN, and Tailwind's runtime which injects a
- * `<style>` element (so inline styles must be allowed).
+ * the configured vendor CDN, and one inline `<style>` in the head. The
+ * nonce covers scripts only, so that rule and every app-authored style
+ * alike are admitted by `'unsafe-inline'` (see the `style-src` note).
  *
  * `script-src` uses `'strict-dynamic'` so a nonce-loaded module can pull
  * in its own dependencies (the importmap-driven per-file ESM graph)
@@ -67,10 +68,25 @@ const CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/;
 const DEFAULT_DIRECTIVES = {
   'default-src': "'self'",
   'script-src': "'nonce-__NONCE__' 'strict-dynamic' 'self' https:",
-  // Tailwind's browser runtime injects a <style> element, and webjs
-  // emits an inline <style> for adopted component styles, so inline
-  // styles must be permitted. Style elements are not a script-injection
-  // vector, so this does not weaken the script protection.
+  // NOTE this directive carries no nonce source, unlike `script-src`, so a
+  // nonce attribute on a <style> is INERT here and every inline style is
+  // admitted by 'unsafe-inline' alone. That includes WebJs's own head rule
+  // (the @layer webjs-host block), which SSR does stamp with the nonce but
+  // which this policy never checks it against. Dropping 'unsafe-inline'
+  // would block that rule too, not only app style.
+  //
+  // What keeps the allowance necessary is inline style with no realistic
+  // nonce path, and it arrives in four shapes. A page or layout may write
+  // an inline <style>, which an author could nonce by hand but does not by
+  // default. A light-DOM component's <style> and a shadow component's
+  // `static styles`, serialized into its declarative shadow root, are both
+  // emitted by the core renderer with no nonce and no way to supply one.
+  // And every style="..." attribute is unfixable in principle, since a
+  // nonce applies to elements and never to attributes. No styling library
+  // is involved in any of them.
+  //
+  // Style elements are not a script-injection vector, so this does not
+  // weaken the script protection.
   'style-src': "'self' 'unsafe-inline'",
   'img-src': "'self' data: https:",
   'font-src': "'self' data: https:",

package/src/csrf.js

@@ -19,7 +19,10 @@
  *   2. When `Sec-Fetch-Site` is absent (an older browser), fall back to
  *      comparing the `Origin` host to the request host; an absent `Origin`
  *      can't be checked so it passes (a handcrafted / non-browser request
- *      can't carry a victim's SameSite cookies cross-site anyway).
+ *      can't carry a victim's SameSite cookies cross-site anyway). That
+ *      request host comes from `requestHost` below, which resolves
+ *      `x-forwarded-host` through the shared `trustProxy()` seam in
+ *      `forwarded.js` (#1104), so this file holds no trust posture of its own.
  *
  * Scope:
  *   - Internal RPC only. A `route.ts` REST endpoint (hand-written or via the
@@ -28,6 +31,8 @@
  *   - Session / auth cookies stay `SameSite=Lax` as defense-in-depth.
  */
 
+import { trustProxy } from './forwarded.js';
+
 /**
  * Parse cookies off a standard Request. Retained as a general cookie reader
  * (used by `context.js` for `cookies()`), independent of CSRF.
@@ -56,21 +61,37 @@ function hostOf(value) {
 }
 
 /**
- * The host the request was addressed to. Honors `x-forwarded-host` first
- * (set by a reverse proxy / CDN like the Cloudflare-in-front-of-Railway
- * setup), then the `Host` header, then the request URL.
+ * The host the request was addressed to: `x-forwarded-host` when a proxy is
+ * trusted to speak for the client (the Cloudflare-in-front-of-Railway setup),
+ * then the `Host` header, then the request URL.
+ *
+ * Trust note, preserved from before this read went through `trustProxy()`
+ * (#1104), because it is correct and non-obvious: reading `x-forwarded-host`
+ * here was never a CSRF weakness. A CSRF attack is browser-driven and a
+ * browser cannot set `x-forwarded-host` (or `Origin`); only a direct
+ * non-browser client can, and such a client carries no victim SameSite
+ * cookies to abuse. The primary `Sec-Fetch-Site` path does not reach this
+ * function at all, only the legacy no-`Sec-Fetch-Site` fallback in
+ * `verifyOrigin` does. The value CAN still be attacker-chosen, since a proxy
+ * of the kind above forwards a client-supplied one rather than overwriting
+ * it; see the threat model in `forwarded.js` for what that does reach.
+ *
+ * What changed is the POSTURE, not a hole: the read now honors
+ * `WEBJS_NO_TRUST_PROXY=1` like every other forwarded-header read, so an
+ * operator who sets the flag because their container is directly reachable
+ * gets one answer from the whole package instead of two. Behind a proxy
+ * WITHOUT the flag nothing changes. With the flag set on a genuinely proxied
+ * deploy (a misconfiguration) the fallback compares `Origin` against the raw
+ * `Host`, so a legitimate cross-host request can now be rejected. That is the
+ * flag's intended meaning.
  *
- * Trust note: `x-forwarded-host` is only meaningful behind a proxy that
- * overwrites it. This is NOT a CSRF weakness, because a CSRF attack is
- * browser-driven and a browser cannot set `x-forwarded-host` (or `Origin`);
- * only a direct non-browser client can, and such a client carries no victim
- * SameSite cookies to abuse. The primary `Sec-Fetch-Site` path does not use
- * this at all.
  * @param {Request} req
  */
 export function requestHost(req) {
-  const xfh = req.headers.get('x-forwarded-host');
-  if (xfh) return xfh.split(',')[0].trim().toLowerCase();
+  if (trustProxy()) {
+    const xfh = req.headers.get('x-forwarded-host');
+    if (xfh) return xfh.split(',')[0].trim().toLowerCase();
+  }
   const host = req.headers.get('host');
   if (host) return host.toLowerCase();
   return hostOf(req.url);

package/src/dev-error.js

@@ -91,9 +91,19 @@ export function readCodeFrame(file, line, column, context = 3) {
 /**
  * Build a dev error frame from an error. DEV-ONLY (the caller gates on `dev`).
  *
+ * `opts.url` stamps the frame with the request URL that produced it (#1047).
+ * Only a `render` frame carries one, and the browser overlay uses it to refuse a
+ * frame belonging to a page the tab is not looking at (another tab's crash, a
+ * background render of some other url, a page navigated away from). A frame with
+ * no url renders unconditionally, which is what a `rebuild` / `ts-strip` frame
+ * wants: those describe a still-broken build, not one URL.
+ *
+ * A speculative link prefetch is NOT in that list, and cannot be: `dev.js` drops
+ * the report hook for one, so no frame is ever built for it to refuse.
+ *
  * @param {unknown} error
- * @param {{ kind?: 'render' | 'ts-strip' | 'rebuild', appDir?: string, file?: string, line?: number, column?: number, hint?: string }} [opts]
- * @returns {{ kind: string, message: string, stack: string|null, file: string|null, line: number|null, column: number|null, codeFrame: string|null, hint: string|null }}
+ * @param {{ kind?: 'render' | 'ts-strip' | 'rebuild', appDir?: string, file?: string, line?: number, column?: number, hint?: string, url?: string }} [opts]
+ * @returns {{ kind: string, message: string, stack: string|null, file: string|null, line: number|null, column: number|null, codeFrame: string|null, hint: string|null, url: string|null }}
  */
 export function buildDevErrorFrame(error, opts = {}) {
   const err = error instanceof Error ? error : new Error(String(error));
@@ -125,5 +135,6 @@ export function buildDevErrorFrame(error, opts = {}) {
     column,
     codeFrame,
     hint: opts.hint || null,
+    url: typeof opts.url === 'string' && opts.url ? opts.url : null,
   };
 }