Skip to content

fix(architect): restore x-forwarded-host default handling for lambda servers - #15389

Open
SnowingFox wants to merge 1 commit into
remix-run:mainfrom
SnowingFox:fix/architect-x-forwarded-host
Open

fix(architect): restore x-forwarded-host default handling for lambda servers#15389
SnowingFox wants to merge 1 commit into
remix-run:mainfrom
SnowingFox:fix/architect-x-forwarded-host

Conversation

@SnowingFox

Copy link
Copy Markdown

Fixes #15378.

PR #15188 removed the useRequestContextDomainName option from the @react-router/architect adapter and made event.requestContext.domainName the sole default when deriving the request host, dropping x-forwarded-host from consideration entirely.

For Lambda Function URLs deployed behind CloudFront, requestContext.domainName is the internal *.lambda-url...on.aws host while the viewer-facing host is carried in the x-forwarded-host header populated by CloudFront. Because request.url was now built with the Lambda URL host, React Router's single-fetch throwIfPotentialCSRFAttack check compared the browser Origin (https://...cloudfront.net) against the Lambda URL and rejected legitimate same-origin browser POSTs.

This restores x-forwarded-host as the priority candidate when constructing the request URL, falling back to requestContext.domainName and then the Host header. That matches the pre-#15188 default behavior for proxied deployments while still preferring the request-context domain name when no proxy header is present.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[@react-router/architect] x-forwarded-host default regression impacting lambda servers

2 participants