Files
windmill/functions/api/[[path]].ts
Ruben FiszelandClaude Opus 5.5 6064aecdec feat: stop cross-origin isolating the raw app editor (#11411)
* feat: stop cross-origin isolating the raw app editor

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0166irwM15U8vZjc58MsU54U

* docs: drop stale raw app editor reload comments

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0166irwM15U8vZjc58MsU54U

* feat: drop wm_coep from the default raw app embed snippet

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0166irwM15U8vZjc58MsU54U

* chore: pin the UI builder that type-checks without cross-origin isolation

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0166irwM15U8vZjc58MsU54U

* docs: name the proxy-isolated case behind the remaining isolation checks

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0166irwM15U8vZjc58MsU54U

---------

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-29 16:52:49 +02:00

52 lines
1.6 KiB
TypeScript

//this is purely for cloudflare pages redirection purposes
export async function onRequest(context) {
// Contents of context object
const {
request, // same as existing Worker API
env, // same as existing Worker API
params, // if filename includes [id] or [[path]]
waitUntil, // same as ctx.waitUntil in existing Worker API
next, // used for middleware or to fetch assets
data, // arbitrary space for passing data between middlewares
} = context;
try {
const url = new URL(request.url);
// Check for remote_url cookie
const cookies = request.headers.get("cookie") || "";
const remoteUrlMatch = cookies.match(/remote_url=([^;]+)/);
const targetHostname = remoteUrlMatch
? decodeURIComponent(remoteUrlMatch[1])
: "app.windmill.dev";
url.hostname = targetHostname;
const res = await fetch(url.toString(), {
method: request.method,
body: request.body,
headers: request.headers,
redirect: "manual",
});
const newResponse = new Response(res.body, res);
// Extract domain from target hostname for cookie domain replacement
const targetDomain = targetHostname.split(".").slice(-2).join(".");
newResponse.headers.set(
"set-cookie",
"token" +
(newResponse.headers
.get("set-cookie")
?.replace(`Domain=${targetDomain};`, "")
?.split("token")
?.pop() ?? "")
);
newResponse.headers.set("Cross-Origin-Resource-Policy", "cross-origin");
return newResponse;
} catch (e) {
return new Response(e.message, { status: 500 });
}
}