bosia 1.2.6 → 1.2.8

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "bosia",
-	"version": "1.2.6",
+	"version": "1.2.8",
 	"type": "module",
 	"engines": {
 		"bun": ">=1.4"

package/src/core/backend.ts

@@ -4,6 +4,16 @@
 // Workers alike.
 // Only the subset the framework and plugins use — not a general router.
 
+import type { Server } from "bun";
+
+import {
+	isUpgradeRequest,
+	isUpgraded,
+	runUpgrade,
+	websocketHandlers,
+	type WebSocketOptions,
+} from "./websocket.ts";
+
 /** Outbound response bag — merged into whatever the handler returns. */
 export interface ResponseSet {
 	status?: number;
@@ -41,10 +51,14 @@ export type ErrorHook = (ctx: { request: Request; error: unknown; set: ResponseS
  * `start`: `performance.now()` when the request entered `fetch`. Observe only:
  * the return value is ignored and a throw or rejection is swallowed. `response`
  * is the one the client gets — don't read its body or change its headers.
+ * `status` is the status the client got: 101 for a WebSocket upgrade, whose
+ * `response` is only a placeholder (a 101 Response can't be built).
  */
 export type ResponseHook = (ctx: {
 	request: Request;
 	response: Response;
+	status: number;
+	upgraded: boolean;
 	start: number;
 }) => void | Promise<unknown>;
 
@@ -52,6 +66,7 @@ export interface ServeOptions {
 	maxRequestBodySize?: number;
 	idleTimeout?: number;
 	reusePort?: boolean;
+	websocket?: WebSocketOptions;
 }
 
 type Method = "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "OPTIONS" | "*";
@@ -150,8 +165,18 @@ export class BosiaApp {
 		return [...methods];
 	}
 
-	fetch = async (request: Request): Promise<Response> => {
-		if (this.responseHooks.length === 0) return this.respond(request);
+	/** `undefined` after a WebSocket upgrade — Bun has already answered with 101.
+	 *  Only Bun passes `server`, so Workers never upgrades. */
+	fetch = (request: Request, server?: Server<any>): Promise<Response | undefined> =>
+		server && isUpgradeRequest(request)
+			? runUpgrade(request, server, () => this.handle(request))
+			: this.handle(request);
+
+	private handle = async (request: Request): Promise<Response | undefined> => {
+		if (this.responseHooks.length === 0) {
+			const response = await this.respond(request);
+			return isUpgraded() ? undefined : response;
+		}
 		const start = performance.now();
 		let response: Response;
 		try {
@@ -162,13 +187,15 @@ export class BosiaApp {
 			throw error;
 		}
 		this.observe(request, response, start);
-		return response;
+		return isUpgraded() ? undefined : response;
 	};
 
 	private observe(request: Request, response: Response, start: number): void {
+		const upgraded = isUpgraded();
+		const status = upgraded ? 101 : response.status;
 		for (const hook of this.responseHooks) {
 			try {
-				const out = hook({ request, response, start });
+				const out = hook({ request, response, status, upgraded, start });
 				// An async observer's rejection would be unhandled — fatal in prod.
 				if (out instanceof Promise) out.catch(() => {});
 			} catch {
@@ -227,6 +254,8 @@ export class BosiaApp {
 			response = "Method Not Allowed";
 		}
 
+		// Bun already sent the 101: nothing after this can change the answer.
+		if (isUpgraded()) return response as Response;
 		for (const hook of this.afterHooks) {
 			const out = await hook({ request, response, set });
 			if (out !== undefined) response = out;
@@ -243,6 +272,7 @@ export class BosiaApp {
 			maxRequestBodySize: serve.maxRequestBodySize,
 			idleTimeout: serve.idleTimeout,
 			reusePort: serve.reusePort ?? false,
+			websocket: { ...websocketHandlers, ...serve.websocket, sendPings: true },
 		});
 		callback?.();
 		return this;

package/src/core/basePath.ts

@@ -30,6 +30,36 @@ export function withBase(base: string, path: string): string {
 	return base + path;
 }
 
+/** Never a navigation target. Test a parsed `URL.protocol`, not the raw string: the
+ *  parser drops tabs, newlines and leading control chars, so `java\tscript:` is one too. */
+export const DANGEROUS_PROTOCOL = /^(javascript|data|vbscript):$/;
+
+/**
+ * What the client router matches: the path the server would see. Every URL goes
+ * through the URL parser against `pageHref`, like a link: `?page=2`, `b`, `../x`
+ * resolve, `/a b` and `/café` get encoded (params match the server's), `/\host`
+ * is another origin. Another origin comes back as its full URL so the router leaves the app.
+ */
+export function toRouterPath(url: string, pageHref: string): string {
+	const u = new URL(url, pageHref);
+	if (DANGEROUS_PROTOCOL.test(u.protocol)) {
+		throw new Error(`navigation: dangerous scheme in URL "${url}". Use a path or an http(s) URL.`);
+	}
+	// Scheme + host, not `origin`: a `blob:` URL shares the page's origin, and the URL
+	// parser gives app shells (`capacitor://localhost`) origin "null" for every host.
+	// A path starting `//` (from `/.//evil.com`) would read as another host once used as
+	// a URL, so it stays a full URL: the router leaves for this origin's `//evil.com` page.
+	const page = new URL(pageHref);
+	// No host (`file:`) is never ours: every file on disk would count as one app.
+	const ours =
+		u.host !== "" &&
+		u.protocol === page.protocol &&
+		u.host === page.host &&
+		!u.pathname.startsWith("//");
+	// `capacitor://localhost` has an empty path: that's the root.
+	return ours ? (u.pathname || "/") + u.search + u.hash : u.href;
+}
+
 /**
  * The in-app pathname for an incoming request, or `null` when the request is
  * not ours to answer. `/sso` and `/sso/` both resolve to `/` so the root route

package/src/core/cache.ts

@@ -275,7 +275,9 @@ export function computeIdentityHash(req: Request, cookies: Pick<CookieJar, "peek
 }
 
 export function computeCacheKey(url: URL, req: Request, cookies: Pick<CookieJar, "peek">): string {
-	return `${dedupKey(url)}|i=${computeIdentityHash(req, cookies)}`;
+	// Origin is in the key: `url` follows the Host / X-Forwarded-* headers, and a
+	// page that renders `url.origin` must not be served to another host.
+	return `${dedupKey(url)}|o=${url.origin}|i=${computeIdentityHash(req, cookies)}`;
 }
 
 // ─── Tracking parameters (CACHE_IGNORE_PARAMS) ───────────
@@ -316,11 +318,19 @@ export function stripIgnoredParams(url: URL): URL {
 }
 
 /** Loaders that read the whole query string (`url.search`, `url.href`, iterating
- *  `url.searchParams`): their output may depend on any param. */
-const wholeQueryDeps = new WeakSet<LoaderDeps>();
-
+ *  `url.searchParams`): their output may depend on any param. Recorded as a `"*"`
+ *  search param (like the `"*"` cookie) so the client router sees it too. A real
+ *  `?*=` param read by name counts as a whole-query read, which only re-runs more. */
 export function markWholeQueryRead(deps: LoaderDeps): void {
-	wholeQueryDeps.add(deps);
+	if (!deps.searchParams.includes("*")) deps.searchParams.push("*");
+}
+
+/** Server-only: the entry is query-aware (a left-out layout above read an ignored
+ *  param), without telling the client router to re-run on every query change. */
+const queryAwareDeps = new WeakSet<LoaderDeps>();
+
+export function markQueryAware(deps: LoaderDeps): void {
+	queryAwareDeps.add(deps);
 }
 
 /** Whether any loader read an ignored param — its entry must not be served to a
@@ -330,16 +340,18 @@ export function depsReadIgnoredParams(
 	pageDeps: LoaderDeps | null,
 ): boolean {
 	const check = (d: LoaderDeps | null) =>
-		!!d && (wholeQueryDeps.has(d) || d.searchParams.some(isIgnoredParam));
+		!!d && (queryAwareDeps.has(d) || d.searchParams.some((k) => k === "*" || isIgnoredParam(k)));
 	if (check(pageDeps)) return true;
 	return !!layoutDeps && layoutDeps.some(check);
 }
 
 /** Extract pathname portion of a cacheKey for path-based invalidation. */
 function pathOfKey(key: string): string {
+	// A path keeps a raw `|` (`/files/a|b`) but never a raw `?`; the query,
+	// origin and 0/1 mask never hold `?` or `|o=`. Storing the path on the
+	// entry would drop this parsing if keys grow free-text parts.
 	const qIdx = key.indexOf("?");
-	const pIdx = key.indexOf("|");
-	const end = qIdx === -1 ? pIdx : Math.min(qIdx, pIdx);
+	const end = qIdx !== -1 ? qIdx : key.lastIndexOf("|o=");
 	return end === -1 ? key : key.slice(0, end);
 }
 

package/src/core/client/App.svelte

@@ -207,7 +207,7 @@
 		const currentTick = appState.invalidationTick; // still tracks reactively
 
 		const path = router.currentRoute;
-		const url = new URL(path, window.location.origin);
+		const url = new URL(path, window.location.href);
 		const pathname = url.pathname;
 		const navKey = pathname + url.search;
 		const match = findMatch(clientRoutes, pathname);
@@ -227,7 +227,7 @@
 		const isFirst = firstNav;
 		firstNav = false;
 		if (isFirst) {
-			const hUrl = new URL(router.hydratedRoute, window.location.origin);
+			const hUrl = new URL(router.hydratedRoute, window.location.href);
 			const hMatch = router.hydratedRoute === path ? match : findMatch(clientRoutes, hUrl.pathname);
 			currentLayoutPaths = (hMatch?.route as any)?.layoutPaths ?? [];
 			// The probes ran during hydration, before this effect. A title other than

package/src/core/client/hydrate.ts

@@ -1,6 +1,6 @@
 import { hydrate, mount } from "svelte";
 import App from "./App.svelte";
-import { router } from "./router.svelte.ts";
+import { locationPath, router } from "./router.svelte.ts";
 import { initPrefetch } from "./prefetch.ts";
 import { findMatch, compileRoutes, canonicalPathname } from "../matcher.ts";
 import { clientRoutes } from "bosia:routes";
@@ -25,7 +25,8 @@ function readJsonScript<T>(id: string): T | null {
 // ─── Hydration ────────────────────────────────────────────
 
 async function main() {
-	const path = window.location.pathname;
+	// The pathname of the route the router will hold (`capacitor://localhost` → `/`).
+	const path = new URL(locationPath(), window.location.href).pathname;
 
 	router.init();
 
@@ -36,7 +37,8 @@ async function main() {
 	// Canonicalize trailing slash on initial mount — server already 308'd if
 	// SSR'd, but `ssr=false` shells and prerendered pages can land on the
 	// non-canonical URL. replaceState (no extra history entry).
-	if (match) {
+	// A `//x` path is skipped: replaceState would read it as host x and throw.
+	if (match && !path.startsWith("//")) {
 		const canonical = canonicalPathname(path, (match.route as any).trailingSlash ?? "never");
 		if (canonical !== null && typeof history !== "undefined") {
 			history.replaceState(
@@ -46,7 +48,7 @@ async function main() {
 			);
 		}
 	}
-	router.currentRoute = window.location.pathname + window.location.search + window.location.hash;
+	router.currentRoute = locationPath();
 	// After canonicalizing, before any await: a click during the chunk loads below
 	// moves currentRoute, and App must still know which route the server rendered.
 	router.hydratedRoute = router.currentRoute;
@@ -84,7 +86,7 @@ async function main() {
 	if (match) {
 		// The server's route, not window.location: a click during the chunk loads
 		// above already moved the address bar on.
-		const url = new URL(router.hydratedRoute, window.location.origin);
+		const url = new URL(router.hydratedRoute, window.location.href);
 		const ctx = liveContext(url.pathname, match.params, url);
 		const ssrPageDeps: LoaderDeps | null = (window as any).__BOSIA_PAGE_DEPS__ ?? null;
 		const ssrLayoutDeps: (LoaderDeps | null)[] = (window as any).__BOSIA_LAYOUT_DEPS__ ?? [];
@@ -169,10 +171,16 @@ if (typeof window !== "undefined" && process.env.NODE_ENV === "production") {
 				} catch {
 					// Storage may be unavailable (private mode) — best effort.
 				}
-				const sep = window.location.search ? "&" : "?";
-				window.location.replace(
-					`${window.location.pathname}${window.location.search}${sep}_v=${Date.now()}${window.location.hash}`,
-				);
+				// Split on `&` and kept as text: searchParams would re-encode the query (breaks
+				// signed URLs), and a pattern could hit a `?_v=` inside a value (`?next=/a?_v=1`).
+				// The last deploy's `_v` goes, so they don't pile up.
+				const url = new URL(window.location.href);
+				const parts = url.search
+					.slice(1)
+					.split("&")
+					.filter((p) => p && !/^_v=\d+$/.test(p));
+				url.search = [...parts, `_v=${Date.now()}`].join("&");
+				window.location.replace(url.href);
 			});
 		}
 	} catch {

package/src/core/client/loaderCache.ts

@@ -15,6 +15,8 @@ export type CacheSnapshot = {
 	pathname: string;
 	params: Record<string, string>;
 	searchParams: Record<string, string | null>;
+	/** The full query, for loaders that read all of it (`"*"` in deps.searchParams). */
+	search: string;
 	cookies: Record<string, string | undefined>;
 };
 
@@ -64,15 +66,21 @@ export function liveContext(
 	};
 }
 
+/** Every value of a query param, so `getAll`/`has(k, v)` see a change past the first. */
+function paramValues(url: URL, k: string): string | null {
+	const all = url.searchParams.getAll(k);
+	return all.length ? JSON.stringify(all) : null;
+}
+
 /** Capture only the values relevant to a loader's tracked deps. */
 export function captureSnapshot(deps: LoaderDeps, ctx: EvalContext): CacheSnapshot {
 	const params: Record<string, string> = {};
 	for (const k of deps.params) params[k] = ctx.params[k] ?? "";
 	const searchParams: Record<string, string | null> = {};
-	for (const k of deps.searchParams) searchParams[k] = ctx.url.searchParams.get(k);
+	for (const k of deps.searchParams) if (k !== "*") searchParams[k] = paramValues(ctx.url, k);
 	const cookies: Record<string, string | undefined> = {};
 	for (const k of deps.cookies) cookies[k] = ctx.cookies[k];
-	return { pathname: ctx.pathname, params, searchParams, cookies };
+	return { pathname: ctx.pathname, params, searchParams, search: ctx.url.search, cookies };
 }
 
 export type DirtyState = {
@@ -108,7 +116,10 @@ export function shouldRerun(entry: CacheEntry, dirty: DirtyState, next: EvalCont
 	}
 	// Search param value changes
 	for (const k of deps.searchParams) {
-		if (snapshot.searchParams[k] !== next.url.searchParams.get(k)) return true;
+		if (k === "*") {
+			// Whole query read: any change re-runs (a reorder too, which is harmless).
+			if (snapshot.search !== next.url.search) return true;
+		} else if (snapshot.searchParams[k] !== paramValues(next.url, k)) return true;
 	}
 	// Cookie value changes
 	for (const k of deps.cookies) {

package/src/core/client/navigation.ts

@@ -73,7 +73,7 @@ export function invalidate(target: InvalidateTarget): Promise<void> {
 			try {
 				// Normalize to an absolute URL — fetches the loader recorded are
 				// always absolute, so a relative `/api/foo` must be promoted here.
-				const abs = new URL(str, window.location.origin).href;
+				const abs = new URL(str, window.location.href).href;
 				appState.dirty.urls.add(abs);
 			} catch {
 				appState.dirty.urls.add(str);

package/src/core/client/prefetch.ts

@@ -7,6 +7,7 @@ import { clientRoutes } from "bosia:routes";
 import { appState } from "./appState.svelte.ts";
 import { liveContext, shouldRerun } from "./loaderCache.ts";
 import { base } from "./base.ts";
+import { appLinkPath, locationPath } from "./router.svelte.ts";
 
 /**
  * Build the `_invalidated` mask bits for a target path using the current
@@ -15,7 +16,7 @@ import { base } from "./base.ts";
  * since they may be guards). Returns `null` when the route cannot be matched.
  */
 export function buildMaskBits(path: string): string | null {
-	const url = new URL(path, window.location.origin);
+	const url = new URL(path, window.location.href);
 	const pathname = url.pathname;
 	const match = findMatch(clientRoutes, pathname);
 	// Prerendered data is a fixed file: nothing to skip, and on Workers only a
@@ -47,7 +48,7 @@ export function buildMaskBits(path: string): string | null {
  * fetch that follows an `invalidate()`, so the server skips its cached copy.
  */
 export function dataUrl(path: string, invalidatedBits?: string, fresh = false): string {
-	const url = new URL(path, window.location.origin);
+	const url = new URL(path, window.location.href);
 	let p = url.pathname.replace(/\/$/, "");
 	let qs = url.search;
 	if (invalidatedBits) {
@@ -79,15 +80,8 @@ function isJsonResponse(res: Response): boolean {
 export async function readDataResponse(res: Response): Promise<any> {
 	// `fetch` follows redirects, so a hook's 303 arrives as the login page's HTML
 	// at status 200. `redirected` is the only surviving trace of the redirect.
-	if (res.redirected) {
-		const target = new URL(res.url, window.location.origin);
-		return {
-			redirect:
-				target.origin === window.location.origin
-					? target.pathname + target.search + target.hash
-					: target.href,
-		};
-	}
+	// router.navigate() turns it into a path (or leaves the app) via toRouterPath.
+	if (res.redirected) return { redirect: res.url };
 	if (isJsonResponse(res)) {
 		try {
 			return await res.json();
@@ -153,10 +147,10 @@ export function clearPrefetches(): void {
 export async function prefetchPath(path: string): Promise<void> {
 	// Nothing to fetch for the page we're on. A click also focuses its link, so
 	// the focusin trigger fires ~100ms after the navigation it belongs to.
-	if (path === window.location.pathname + window.location.search) return;
+	if (path === locationPath().split("#")[0]) return;
 	// Warm the route's +loading.svelte chunk alongside its data, so the skeleton
 	// paints instantly on click instead of cold-importing after the old page lingers.
-	const warmMatch = findMatch(clientRoutes, new URL(path, window.location.origin).pathname);
+	const warmMatch = findMatch(clientRoutes, new URL(path, window.location.href).pathname);
 	// Also warm the page and layout chunks: a route not visited yet otherwise
 	// downloads its code only after the click. Errors are swallowed — a stale
 	// chunk is the click's to report, not the hover's (hydrate.ts reloads on it).
@@ -209,10 +203,8 @@ export async function prefetchPath(path: string): Promise<void> {
 }
 
 function getLinkHref(anchor: HTMLAnchorElement): string | null {
-	if (anchor.origin !== window.location.origin) return null;
-	if (anchor.target) return null;
-	if (anchor.hasAttribute("download")) return null;
-	return anchor.pathname + anchor.search;
+	// The click handler's own check; the cache is keyed without the hash.
+	return appLinkPath(anchor)?.split("#")[0] ?? null;
 }
 
 function observeViewportLinks(container: Element | Document = document) {

package/src/core/client/router.svelte.ts

@@ -6,7 +6,7 @@ import { findMatch, canonicalPathname } from "../matcher.ts";
 import { clientRoutes } from "bosia:routes";
 import { fireBeforeNavigate, type Navigation } from "./navListeners.ts";
 import { base } from "./base.ts";
-import { withBase } from "../basePath.ts";
+import { toRouterPath, withBase } from "../basePath.ts";
 
 // Everything here is a real browser path, base and all. Under a BASE_PATH mount
 // the generated `clientRoutes` carry the prefix too, so an anchor's href, the
@@ -20,9 +20,9 @@ export type NavResult = "started" | "same" | "cancelled" | "left";
 
 function buildTarget(path: string): { url: URL; params: Record<string, string> } | null {
 	if (typeof window === "undefined") return null;
-	const pathname = path.split("?")[0].split("#")[0];
-	const match = findMatch(clientRoutes, pathname);
-	const url = new URL(path, window.location.origin);
+	// From the URL, not a string split: the route may be a full URL (`http://host//x`).
+	const url = new URL(path, window.location.href);
+	const match = findMatch(clientRoutes, url.pathname);
 	return { url, params: match?.params ?? {} };
 }
 
@@ -74,15 +74,36 @@ export function scrollToHash(hash: string): boolean {
 	return true;
 }
 
+/** The address bar as a router path. Never raw `location.pathname`: a `//evil.com` path
+ *  would read as a host wherever the route is used as a URL; toRouterPath keeps it a full URL. */
+export function locationPath(): string {
+	return toRouterPath(window.location.href, window.location.href);
+}
+
+/** The router path an `<a>` goes to, or null when the browser should follow it: `target`,
+ *  `download`, `rel="external"`, or anything toRouterPath doesn't call ours (another
+ *  scheme or host, no host like `file:`, a `//x` path, a `javascript:` href).
+ *  The click handler and hover prefetch both use it, so they can't disagree. */
+export function appLinkPath(anchor: HTMLAnchorElement): string | null {
+	// No href (`<a role="button">`) is not a link: `anchor.href` "" would read as this page.
+	if (!anchor.hasAttribute("href")) return null;
+	if (anchor.target || anchor.hasAttribute("download")) return null;
+	// HTML splits `rel` on ASCII whitespace only, and ignores case.
+	if (/(^|[\t\n\f\r ])external([\t\n\f\r ]|$)/i.test(anchor.rel)) return null;
+	try {
+		const path = toRouterPath(anchor.href, window.location.href);
+		return path.startsWith("/") ? path : null;
+	} catch {
+		return null; // a dangerous scheme: the browser handles it, as on any page
+	}
+}
+
 export const router = new (class Router {
-	currentRoute = $state(
-		typeof window !== "undefined"
-			? window.location.pathname + window.location.search + window.location.hash
-			: "/",
-	);
-	/** Origin half of `page.url`. Empty on the server until the renderer seeds it
-	 *  per request — see `renderWithPageContext` in core/renderer.ts. */
-	origin = $state(typeof window !== "undefined" ? window.location.origin : "");
+	currentRoute = $state(typeof window !== "undefined" ? locationPath() : "/");
+	/** Base `page.url` resolves the route against. Empty on the server until the renderer
+	 *  seeds it per request — see `renderWithPageContext` in core/renderer.ts. The href on the
+	 *  client: `location.origin` can be "null" (app shell, sandboxed iframe), not a valid base. */
+	origin = $state(typeof window !== "undefined" ? window.location.href : "");
 	/** True when navigation was triggered by a link click / navigate() call, false on popstate (back/forward). */
 	isPush = $state(true);
 	/** Source of the most recent navigation — feeds the Navigation object passed to lifecycle hooks. */
@@ -103,6 +124,8 @@ export const router = new (class Router {
 	loading = false;
 
 	navigate(path: string, opts: { replace?: boolean; source?: NavType } = {}): NavResult {
+		// goto, use:enhance and loader redirects may hand over `?page=2` or a full URL.
+		path = toRouterPath(path, window.location.href);
 		if (this.currentRoute === path) return "same";
 		// Unknown route — let the server handle it (renders +error.svelte with 404)
 		const queryHash = path.slice(path.split("?")[0].split("#")[0].length);
@@ -201,19 +224,15 @@ export const router = new (class Router {
 
 			const anchor = (e.target as HTMLElement).closest("a");
 			if (!anchor) return;
-			if (anchor.origin !== window.location.origin) return;
-			if (anchor.target) return;
-			if (anchor.hasAttribute("download")) return;
-			if (anchor.rel.split(/\s+/).includes("external")) return;
-			if (anchor.protocol !== "https:" && anchor.protocol !== "http:") return;
+			const path = appLinkPath(anchor);
+			if (path === null) return;
 
 			// Same-page hash navigation: skip page reload, just update URL and scroll
 			// to the target element. Mirrors browser default for in-page anchors.
-			const samePage =
-				anchor.pathname === window.location.pathname && anchor.search === window.location.search;
+			const samePage = path.split("#")[0] === locationPath().split("#")[0];
 			if (samePage && anchor.hash) {
 				e.preventDefault();
-				const finalPath = anchor.pathname + anchor.search + anchor.hash;
+				const finalPath = path;
 				if (this.currentRoute !== finalPath) {
 					saveScroll();
 					savePageSnapshot();
@@ -227,12 +246,12 @@ export const router = new (class Router {
 			}
 
 			e.preventDefault();
-			this.navigate(anchor.pathname + anchor.search + anchor.hash, { source: "link" });
+			this.navigate(path, { source: "link" });
 		});
 
 		// Browser back/forward
 		window.addEventListener("popstate", (e) => {
-			const finalPath = window.location.pathname + window.location.search + window.location.hash;
+			const finalPath = locationPath();
 			// Save the position of the entry we're leaving (historyIndex is still
 			// the old entry's), then look up where the landed-on entry was.
 			saveScroll();

package/src/core/cookies.ts

@@ -6,16 +6,17 @@ import { currentBase } from "./appBase.ts";
 const UNSAFE_COOKIE_VALUE = /[;\r\n]/;
 /**
  * Accept both casings (matches SvelteKit/Express convention) and write the
- * canonical capitalized form into the Set-Cookie header.
+ * canonical capitalized form into the Set-Cookie header. A Map, so names like
+ * "constructor" are rejected rather than inherited.
  */
-const SAMESITE_NORMALIZE: Record<string, "Strict" | "Lax" | "None"> = {
-	strict: "Strict",
-	lax: "Lax",
-	none: "None",
-	Strict: "Strict",
-	Lax: "Lax",
-	None: "None",
-};
+const SAMESITE_NORMALIZE = new Map<string, "Strict" | "Lax" | "None">([
+	["strict", "Strict"],
+	["lax", "Lax"],
+	["none", "None"],
+	["Strict", "Strict"],
+	["Lax", "Lax"],
+	["None", "None"],
+]);
 
 /**
  * RFC 6265 §4.1.1: cookie-name is an HTTP token (RFC 2616 §2.2).
@@ -37,13 +38,15 @@ const COOKIE_DEFAULTS: CookieOptions = {
 // ─── Cookie Helpers ──────────────────────────────────────
 
 function parseCookies(header: string): Record<string, string> {
-	const result: Record<string, string> = {};
+	// No prototype, so `get("constructor")` is undefined. `__proto__` is dropped
+	// (as a plain `{}` did): kept, getAll() would hand serializers that key.
+	const result: Record<string, string> = Object.create(null);
 	for (const pair of header.split(";")) {
 		const idx = pair.indexOf("=");
 		if (idx === -1) continue;
 		const name = pair.slice(0, idx).trim();
 		const value = pair.slice(idx + 1).trim();
-		if (name) {
+		if (name && name !== "__proto__") {
 			try {
 				result[name] = decodeURIComponent(value);
 			} catch {
@@ -144,7 +147,7 @@ export class CookieJar implements Cookies {
 		if (opts.httpOnly) header += "; HttpOnly";
 		if (opts.secure) header += "; Secure";
 		if (opts.sameSite) {
-			const canonical = SAMESITE_NORMALIZE[opts.sameSite as string];
+			const canonical = SAMESITE_NORMALIZE.get(opts.sameSite as string);
 			if (!canonical) throw new Error(`Invalid cookie sameSite: ${opts.sameSite}`);
 			header += `; SameSite=${canonical}`;
 		}

package/src/core/csrf.ts

@@ -6,7 +6,7 @@
 // is treated as a cross-origin attack.
 
 export interface CsrfConfig {
-	/** Whether to enforce origin checks. Default: true. */
+	/** Whether to enforce the form-post origin check. WebSocket upgrades are always checked. Default: true. */
 	checkOrigin: boolean;
 	/** Additional origins to allow (e.g. CDN or mobile app origin). */
 	allowedOrigins?: string[];
@@ -39,7 +39,8 @@ function isPathExempt(pathname: string, patterns: string[]): boolean {
 }
 
 /**
- * Check whether a request passes CSRF validation.
+ * Check whether a request passes CSRF validation against `url.origin` — the
+ * public origin, which server.ts has already rebuilt from X-Forwarded-*.
  * Returns `null` on success, or an error message string to reject with 403.
  */
 export function checkCsrf(
@@ -51,23 +52,7 @@ export function checkCsrf(
 	if (SAFE_METHODS.has(request.method.toUpperCase())) return null;
 	if (config.exemptPaths && isPathExempt(url.pathname, config.exemptPaths)) return null;
 
-	// Derive the expected origin.
-	// `X-Forwarded-*` headers are only trusted when `TRUST_PROXY=true`, since a
-	// directly-exposed server would otherwise let a client spoof its own origin
-	// via attacker-controlled forwarded headers. Behind a real reverse proxy
-	// (nginx, Caddy, Cloudflare) the operator opts in by setting the env.
-	const trustProxy = process.env.TRUST_PROXY === "true";
-	const forwardedHost = trustProxy ? request.headers.get("x-forwarded-host") : null;
-	const host = forwardedHost ?? request.headers.get("host");
-	const forwardedProto = trustProxy ? request.headers.get("x-forwarded-proto") : null;
-	const protocol = forwardedProto ?? url.protocol.replace(":", "");
-	const expectedOrigin = host ? `${protocol}://${host}` : url.origin;
-
-	// expectedOrigin is per-request (host-derived), so no Set to precompute — a
-	// direct compare plus the tiny static allow-list avoids a per-request alloc.
-	const extraOrigins = config.allowedOrigins;
-	const isAllowed = (origin: string) =>
-		origin === expectedOrigin || (extraOrigins ? extraOrigins.includes(origin) : false);
+	const isAllowed = (origin: string) => originAllowed(origin, url.origin, config);
 
 	// Check Origin header first (sent by all modern browsers on cross-origin requests)
 	const originHeader = request.headers.get("origin");
@@ -91,3 +76,31 @@ export function checkCsrf(
 	// Neither Origin nor Referer present — reject
 	return "Forbidden: missing Origin or Referer header on non-safe request";
 }
+
+/**
+ * Origin check for a WebSocket upgrade — a GET, so checkCsrf skips it, yet a
+ * cross-site page could open a socket that carries the user's cookies.
+ * Browsers always send `Origin` on a WebSocket handshake; a request without one
+ * comes from a non-browser client (no ambient cookies to hijack) and passes.
+ * Returns `null` on success, or an error message string to reject with 403.
+ */
+export function checkUpgradeOrigin(
+	request: Request,
+	url: URL,
+	config: CsrfConfig = DEFAULT_CSRF_CONFIG,
+): string | null {
+	// Not gated on checkOrigin: turning off the form check must not also open
+	// sockets to cross-site hijacking. CSRF_EXEMPT_PATHS is the way out.
+	if (config.exemptPaths && isPathExempt(url.pathname, config.exemptPaths)) return null;
+	const originHeader = request.headers.get("origin");
+	if (!originHeader || originAllowed(originHeader, url.origin, config)) {
+		return null;
+	}
+	return `Cross-origin WebSocket blocked: Origin "${originHeader}" is not allowed`;
+}
+
+// The expected origin is per-request (url.origin), so no Set to precompute —
+// a direct compare plus the tiny static allow-list.
+function originAllowed(origin: string, expected: string, config: CsrfConfig): boolean {
+	return origin === expected || (config.allowedOrigins?.includes(origin) ?? false);
+}