Skip to content

feat: use proxy shared secret in vite plugin#12393

Merged
jamesopstad merged 3 commits intocloudflare:mainfrom
BlankParticle:blank/fix/vite-plugin-trust-proxy
Feb 6, 2026
Merged

feat: use proxy shared secret in vite plugin#12393
jamesopstad merged 3 commits intocloudflare:mainfrom
BlankParticle:blank/fix/vite-plugin-trust-proxy

Conversation

@BlankParticle
Copy link
Copy Markdown
Contributor

@BlankParticle BlankParticle commented Feb 3, 2026

This was a bit of a rabbit hole, I started by figuring out why the Host header while using vite plugin was different. I saw that wrangler dev doesn't have this issue, and traced it to this code in wrangler is implementation

https://github.com/cloudflare/workers-sdk/blob/main/packages/miniflare/src/workers/core/entry.worker.ts#L110-L113

with some figuring out, I found that wrangler used a shared proxy secret which in turn allows entry.worker.ts to rewrite the Host header to the url. So I did the same in the vite plugin.

this required me to drill through the plugin context to bunch of places, I didn't just pass the secret because just having ctx would be useful for other things in future. And with that, the Entry Worker now trusts vite's handler and I get my correct Host header.

Here is a reproduction of the issue: https://github.com/BlankParticle/cf-vite-plugin-host-header-reproduction

related #10884


  • Tests
    • Tests included/updated
    • Automated tests not possible - manual testing has been completed as follows:
    • Additional testing not necessary because:
  • Public documentation
    • Cloudflare docs PR(s):
    • Documentation not necessary because: vite-plugin

A picture of a cute animal (not mandatory, but encouraged)
image


Open with Devin

@BlankParticle BlankParticle requested a review from a team as a code owner February 3, 2026 18:41
@changeset-bot
Copy link
Copy Markdown

changeset-bot Bot commented Feb 3, 2026

🦋 Changeset detected

Latest commit: 501a9c0

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

Copy link
Copy Markdown
Contributor

@devin-ai-integration devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 3 additional flags.

Open in Devin Review

@pkg-pr-new
Copy link
Copy Markdown

pkg-pr-new Bot commented Feb 3, 2026

create-cloudflare

npm i https://pkg.pr.new/create-cloudflare@12393

@cloudflare/kv-asset-handler

npm i https://pkg.pr.new/@cloudflare/kv-asset-handler@12393

miniflare

npm i https://pkg.pr.new/miniflare@12393

@cloudflare/pages-shared

npm i https://pkg.pr.new/@cloudflare/pages-shared@12393

@cloudflare/unenv-preset

npm i https://pkg.pr.new/@cloudflare/unenv-preset@12393

@cloudflare/vite-plugin

npm i https://pkg.pr.new/@cloudflare/vite-plugin@12393

@cloudflare/vitest-pool-workers

npm i https://pkg.pr.new/@cloudflare/vitest-pool-workers@12393

@cloudflare/workers-editor-shared

npm i https://pkg.pr.new/@cloudflare/workers-editor-shared@12393

@cloudflare/workers-utils

npm i https://pkg.pr.new/@cloudflare/workers-utils@12393

wrangler

npm i https://pkg.pr.new/wrangler@12393

commit: 501a9c0

Copy link
Copy Markdown
Contributor

@petebacondarwin petebacondarwin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This seems like a good fix to me

Copy link
Copy Markdown
Contributor

@jamesopstad jamesopstad left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks a lot for the contribution! This is something we had been meaning to do and hadn't got to. I'll approve once you've made the suggested changes.

Comment thread .changeset/modern-dots-chew.md Outdated
Comment thread packages/vite-plugin-cloudflare/playground/worker-♫/__tests__/worker.spec.ts Outdated
Comment thread packages/vite-plugin-cloudflare/src/context.ts Outdated
@BlankParticle
Copy link
Copy Markdown
Contributor Author

applied your suggestions!

@github-project-automation github-project-automation Bot moved this from Untriaged to Approved in workers-sdk Feb 6, 2026
@jamesopstad jamesopstad merged commit fd8b3e5 into cloudflare:main Feb 6, 2026
34 checks passed
@github-project-automation github-project-automation Bot moved this from Approved to Done in workers-sdk Feb 6, 2026
@BlankParticle BlankParticle deleted the blank/fix/vite-plugin-trust-proxy branch February 6, 2026 12:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

4 participants