mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-10-12 16:02:56 +00:00
* feat: stop cross-origin isolating the raw app editor Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0166irwM15U8vZjc58MsU54U * docs: drop stale raw app editor reload comments Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0166irwM15U8vZjc58MsU54U * feat: drop wm_coep from the default raw app embed snippet Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0166irwM15U8vZjc58MsU54U * chore: pin the UI builder that type-checks without cross-origin isolation Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0166irwM15U8vZjc58MsU54U * docs: name the proxy-isolated case behind the remaining isolation checks Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0166irwM15U8vZjc58MsU54U --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
52 lines
1.6 KiB
TypeScript
52 lines
1.6 KiB
TypeScript
//this is purely for cloudflare pages redirection purposes
|
|
|
|
export async function onRequest(context) {
|
|
// Contents of context object
|
|
const {
|
|
request, // same as existing Worker API
|
|
env, // same as existing Worker API
|
|
params, // if filename includes [id] or [[path]]
|
|
waitUntil, // same as ctx.waitUntil in existing Worker API
|
|
next, // used for middleware or to fetch assets
|
|
data, // arbitrary space for passing data between middlewares
|
|
} = context;
|
|
|
|
try {
|
|
const url = new URL(request.url);
|
|
|
|
// Check for remote_url cookie
|
|
const cookies = request.headers.get("cookie") || "";
|
|
const remoteUrlMatch = cookies.match(/remote_url=([^;]+)/);
|
|
const targetHostname = remoteUrlMatch
|
|
? decodeURIComponent(remoteUrlMatch[1])
|
|
: "app.windmill.dev";
|
|
|
|
url.hostname = targetHostname;
|
|
const res = await fetch(url.toString(), {
|
|
method: request.method,
|
|
body: request.body,
|
|
headers: request.headers,
|
|
redirect: "manual",
|
|
});
|
|
const newResponse = new Response(res.body, res);
|
|
|
|
// Extract domain from target hostname for cookie domain replacement
|
|
const targetDomain = targetHostname.split(".").slice(-2).join(".");
|
|
|
|
newResponse.headers.set(
|
|
"set-cookie",
|
|
"token" +
|
|
(newResponse.headers
|
|
.get("set-cookie")
|
|
?.replace(`Domain=${targetDomain};`, "")
|
|
?.split("token")
|
|
?.pop() ?? "")
|
|
);
|
|
|
|
newResponse.headers.set("Cross-Origin-Resource-Policy", "cross-origin");
|
|
return newResponse;
|
|
} catch (e) {
|
|
return new Response(e.message, { status: 500 });
|
|
}
|
|
}
|