Repository navigation
fix: validate schemeful action origins - #15419
Merged
brophdawg11 merged 1 commit intoAug 20, 2026
Merged
Conversation
Assisted-By: devx/597728f0-1b3f-4153-b929-18dbff6cd683
Contributor
Preview Build AvailablePreview builds have been created for this PR. You can install pnpm install "remix-run/react-router#preview/pr-15419&path:packages/react-router"And/or install other packages via: pnpm install "remix-run/react-router#preview/pr-15419&path:packages/react-router-dev"
pnpm install "remix-run/react-router#preview/pr-15419&path:packages/react-router-express"
pnpm install "remix-run/react-router#preview/pr-15419&path:packages/react-router-node"
pnpm install "remix-run/react-router#preview/pr-15419&path:packages/react-router-serve"These preview builds will be updated automatically as you push new commits. |
Contributor
✅ CLA SignedThanks for signing the Contributor License Agreement. |
Contributor
✅ Change File FoundOne or more change files found.
|
Contributor
|
The preview branch |
brophdawg11
deleted the
brophdawg11/codex-validate-schemeful-action-origins
branch
August 20, 2026 19:48
Merged
Contributor
|
🤖 Hello there, We recently published version Thanks! |
9 tasks
mattdjenkinson
added a commit
to datum-cloud/cloud-portal
that referenced
this pull request
Sep 9, 2026
…1513) ## Summary Every project page on staging fails with "Unexpected Server Error" since #1512 rolled out. react-router 8.3.1 (upstream remix-run/react-router#15419) tightened its CSRF guard to compare the browser's `Origin` header against `request.url` including the scheme. The gateway terminates TLS, so the pod sees `http://cloud.staging.env.datum.net/...` while the browser sends `Origin: https://cloud.staging.env.datum.net`, and the guard rejects every action POST, starting with the project layout's session-cookie action that fires on entering a project. Two commits, released together: 1. **Allowlist the public hostnames** through `allowedActionOrigins`, React Router's documented escape hatch for reverse proxies. The guard stays active for any other origin. 2. **Honour `X-Forwarded-Proto`** with a small Hono middleware, first in the global chain, that rebuilds the request React Router receives with an `https://` URL whenever the header is exactly `https`. Method, headers, body and abort signal carry over, and Sentry spans, session cookies and redirects all see the corrected URL. A missing header or any other value leaves the request untouched, so local dev and E2E are unaffected. `X-Forwarded-Host` is deliberately not honoured because the HTTPRoute never rewrites `Host`. Verified against the production build: with the allowlist, POSTs with an Origin of `cloud.staging.env.datum.net`, `cloud.datum.net` or `cloud.prod.env.datum.net` return 204 while `evil.example.com` still returns 400; with the middleware, the failing POST returns 204 once `X-Forwarded-Proto: https` is present and 400 without it. Four unit tests cover the middleware. ## Notes for reviewers Production is still on v0.8.19 and unaffected until the next tag. The one thing not verifiable locally is the gateway actually sending `X-Forwarded-Proto: https`; Envoy does by default, and the allowlist covers staging regardless. Supersedes #1514. Refs #1512
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this change?
Improves validation of action request origins by considering the complete URL context.
Explicit
allowedActionOriginshostname and wildcard behavior remains unchanged.Testing
react-routertypecheck