fix(ssr): trust proxy headers, and stop offering rollover and PDF - #4
Merged
Conversation
SSR was off on the deploy, and not for the documented reason. Angular
deopts to client-side rendering on any untrusted `x-forwarded-*` header —
a normal 200 that was never server-rendered. Its default covers only host
and proto; Render also sends `x-forwarded-for`. A host-allowlist miss, what
the docs blamed, is a hard 400 instead.
Reproduced locally first, with Angular naming the header in its own log:
curl -s -H 'X-Forwarded-For: 203.0.113.9' localhost:8080/ -> no marker
`frontend/src/server.ts` now trusts the full set, reading
NG_TRUST_PROXY_HEADERS first so a deploy can narrow it. `verify-deploy.mjs`
gave the wrong advice for this and now branches on the status code.
Also removes two false affordances:
- The Budgets "roll unspent budget into next month" checkbox, read by
nothing. Column and DTO field stay; a spec fails if it returns without
the behaviour.
- `format: 'pdf'`, advertised in the tool schema and silently answered with
CSV. Now rejected at all four layers, with a contract spec pinning the
tool schema and the backend DTO to the same list.
Verified: `format: pdf` -> 400, `csv` -> 201, and verify:deploy passes all
six against the composed server locally.
Gate: 898 tests green, typechecks and build clean. Needs a redeploy — the
fix is in the built SSR bundle.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SSR was off on the deploy, and not for the documented reason. Angular deopts to client-side rendering on any untrusted
x-forwarded-*header — a normal 200 that was never server-rendered. Its default covers only host and proto; Render also sendsx-forwarded-for. A host-allowlist miss, what the docs blamed, is a hard 400 instead.Reproduced locally first, with Angular naming the header in its own log:
frontend/src/server.tsnow trusts the full set, reading NG_TRUST_PROXY_HEADERS first so a deploy can narrow it.verify-deploy.mjsgave the wrong advice for this and now branches on the status code.Also removes two false affordances:
format: 'pdf', advertised in the tool schema and silently answered with CSV. Now rejected at all four layers, with a contract spec pinning the tool schema and the backend DTO to the same list.Verified:
format: pdf-> 400,csv-> 201, and verify:deploy passes all six against the composed server locally.Gate: 898 tests green, typechecks and build clean. Needs a redeploy — the fix is in the built SSR bundle.