fix: clone request headers instead of mutating in single-flight (#2121)

Author: atilafassina

.changeset/funny-pandas-clean.md

@@ -0,0 +1,5 @@
+---
+"@solidjs/start": patch
+---
+
+fix: clone request headers in single-flight to avoid mutating immutable headers

packages/start/src/server/server-functions-handler.spec.ts

@@ -0,0 +1,85 @@
+import { describe, expect, it, vi, beforeEach } from "vitest";
+import type { FetchEvent } from "./types.ts";
+
+vi.mock("h3", () => ({
+  parseCookies: vi.fn(() => ({})),
+  parseSetCookie: vi.fn(),
+}));
+
+vi.mock("solid-js/web", () => ({
+  renderToString: vi.fn(),
+  provideRequestEvent: vi.fn((_event, fn) => fn()),
+}));
+
+vi.mock("solidstart:server-fn-manifest", () => ({
+  getServerFnById: vi.fn(),
+}));
+
+vi.mock("./handler.ts", () => ({
+  createPageEvent: vi.fn(),
+}));
+
+vi.mock("./fetchEvent.ts", () => ({
+  getFetchEvent: vi.fn(),
+  mergeResponseHeaders: vi.fn(),
+}));
+
+function createMockFetchEvent(headers: Record<string, string> = {}): FetchEvent {
+  return {
+    request: new Request("http://localhost/test", { headers }),
+    response: {
+      headers: {
+        getSetCookie: () => [],
+      },
+    },
+    nativeEvent: {},
+    locals: {},
+  } as FetchEvent;
+}
+
+describe("createSingleFlightHeaders", () => {
+  let createSingleFlightHeaders: (sourceEvent: FetchEvent) => Headers;
+
+  beforeEach(async () => {
+    vi.clearAllMocks();
+    const module = await import("./server-functions-handler.ts");
+    createSingleFlightHeaders = module.createSingleFlightHeaders;
+  });
+
+  it("should create a new Headers object instead of returning the original", () => {
+    const sourceEvent = createMockFetchEvent({
+      "content-type": "application/json",
+    });
+
+    const result = createSingleFlightHeaders(sourceEvent);
+
+    expect(result).not.toBe(sourceEvent.request.headers);
+  });
+
+  it("should not mutate the original request headers", () => {
+    const originalHeaders = new Headers({
+      "content-type": "application/json",
+      "cookie": "session=abc123",
+      "cf-ray": "abc123",
+      "cf-cache-status": "HIT",
+    });
+    const sourceEvent: FetchEvent = {
+      request: new Request("http://localhost/test", { headers: originalHeaders }),
+      response: {
+        headers: {
+          getSetCookie: () => [],
+        },
+      },
+      nativeEvent: {},
+      locals: {},
+    } as FetchEvent;
+
+    const originalCookieHeader = sourceEvent.request.headers.get("cookie");
+    const originalCfRay = sourceEvent.request.headers.get("cf-ray");
+
+    createSingleFlightHeaders(sourceEvent);
+
+    expect(sourceEvent.request.headers.get("cookie")).toBe(originalCookieHeader);
+    expect(sourceEvent.request.headers.get("cf-ray")).toBe(originalCfRay);
+  });
+});

packages/start/src/server/server-functions-handler.ts

@@ -195,12 +195,12 @@ function handleNoJS(result: any, request: Request, parsed: any[], thrown?: boole
 }
 
 let App: any;
-function createSingleFlightHeaders(sourceEvent: FetchEvent) {
+export function createSingleFlightHeaders(sourceEvent: FetchEvent) {
   // cookie handling logic is pretty simplistic so this might be imperfect
   // unclear if h3 internals are available on all platforms but we need a way to
   // update request headers on the underlying H3 event.
 
-  const headers = sourceEvent.request.headers;
+  const headers = new Headers(sourceEvent.request.headers);
   const cookies = parseCookies(sourceEvent.nativeEvent);
   const SetCookies = sourceEvent.response.headers.getSetCookie();
   headers.delete("cookie");

packages/start/tsconfig.json

@@ -20,4 +20,5 @@
     "rootDir": "./src",
   },
   "include": ["env.d.ts", "./src", "./src/env.d.ts"],
+  "exclude": ["**/*.spec.ts"]
 }