fix(vercel): static headers

[ematipico]

Changes

Closes #13996

The information regarding the headers were saved in the wrong place. This PR fixes that by putting the information in the routes field: https://github.com/vercel/examples/blob/main/build-output-api/routes/.vercel/output/config.json

Testing

Updated the tests

Docs

N/A

[changeset-bot]

🦋 Changeset detected

Latest commit: b1d6ad5

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[wKovacs64]

This doesn't seem to work, unless I missed something.

Deployed URL of the minimal example (patched with these changes):

https://github-2y2x5yu5-kre74eab7-justin-halls-projects-df945a1f.vercel.app

.vercel/output/config.json:

{
        "version": 3,
        "routes": [
                {
                        "handle": "filesystem"
                },
                {
                        "src": "^/_astro/(.*)$",
                        "headers": {
                                "cache-control": "public, max-age=31536000, immutable"
                        },
                        "continue": true
                },
                {
                        "src": "/",
                        "headers": {
                                "content-security-policy": "script-src 'self' 'sha256-BF0290pkb3jxQsE7z00xR8Imp8X34FLC88L0lkMnrGw=' 'sha256-QzWFZi+FLIx23tnm9SBU4aEgx4x8DsuASP07mfqol/c=' 'sha256-0chmwFk0zaA528yFfGV7J9ppIpdfTPPULncDF3WG7Zs=' 'sha256-eIXWvAmxkr251LJZkjniEK5LcPF3NkapbJepohwYRIc=' 'sha256-Q2BPg90ZMplYY+FSdApNErhpWafg2hcRRbndmvxuL/Q='; style-src 'self' ;"
                        }
                }
        ]
}

Results:

https://securityheaders.com/?q=https%3A%2F%2Fgithub-2y2x5yu5-kre74eab7-justin-halls-projects-df945a1f.vercel.app&hide=on&followRedirects=on

[wKovacs64]

Any thoughts on this, @ematipico?

[ematipico]

Not really, to be honest :/

[wKovacs64]

@ematipico After hours of debugging, it seems to be a route ordering issue related to be the { "handle": "filesystem" } entry that Astro is including in routes (it currently comes in as part of redirects). Moving { "handle": "filesystem" } from first to last in the final routes array that gets written to the Vercel config allows the CSP (and all other headers) to work. Not exactly sure what the priority should be, but I'm guessing redirects > finalRoutes | headerRoutes > { "handle": "filesystem" }.

I hope this is helpful - let me know what you think.

[ematipico]

Thank you, @wKovacs64, for your insights. Unfortunately, I don't know what you're talking about, and I don't know if I need to fix something or if it's something related to the docs. Do you have some link where I can read more about { "handle": "filesystem" }?

[ematipico]

I added a warning in case that field is in the first place

[ascorbic]

@ematipico I think it must be something generated by @vercel/routing-utils when we call normalizeRoutes. It's not in our code.

[ascorbic]

This is the generated .vercel/config.json in our basic vercel fixture.

{
	"version": 3,
	"routes": [
		{
			"handle": "filesystem"
		},
		{
			"src": "^/_astro/(.*)$",
			"headers": {
				"cache-control": "public, max-age=31536000, immutable"
			},
			"continue": true
		}
	]
}

[ematipico]

Ah, thank you @ascorbic! I opened a feature request here vercel/vercel#13631

In the meantime, I think I will patch the behaviour, and shift the entry to the last place.

[pkg-pr-new]

npm i https://pkg.pr.new/astro@14039

npm i https://pkg.pr.new/@astrojs/markdoc@14039

npm i https://pkg.pr.new/@astrojs/node@14039

npm i https://pkg.pr.new/@astrojs/vercel@14039

commit: b1d6ad5

[ascorbic]

Does this change mean that on-demand dynamic routes will match before static files? I don't really know the config format, but the implication is that it looks at the filesystem before looking at server routes. Maybe you should be adding the headers to that entry, instead of moving it?

[ematipico]

Maybe you should be adding the headers to that entry, instead of moving it?

I didn't understand this part 🤔

[wKovacs64]

Does this change mean that on-demand dynamic routes will match before static files? I don't really know the config format, but the implication is that it looks at the filesystem before looking at server routes. Maybe you should be adding the headers to that entry, instead of moving it?

That's certainly the implication. Just to be clear, you want the priority to be: redirects | header routes (like CSP) > { "handle": "filesystem" } > dynamic routes?

[wKovacs64]

Maybe you should be adding the headers to that entry, instead of moving it?

I didn't understand this part 🤔

I think he's proposing adding the headers to the { "handle": "filesystem" } route entry that normalizeRoutes adds, but I don't think that works. Have not tested yet, though.

[0xJoeDev]

@ematipico Anything holding this one back from getting merged? Really looking forward to this feature!

[ematipico]

@ematipico Anything holding this one back from getting merged? Really looking forward to this feature!

Yes. We're unsure about the correct approach. Unfortunately the lack of documentation is holding us back from creating the correct solution

[wKovacs64]

I think we can figure it out, we just need consensus on the desired priority. Does Astro want dynamic routes or filesystem routes to match first?

[ematipico]

@wKovacs64, technically, yes, static routes should be prioritised. I don't know how the configuration will look with static headers for static pages.