-
Notifications
You must be signed in to change notification settings - Fork 91
Feat/skew protection #3147
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Draft
Draft
Feat/skew protection #3147
+2,003
−10
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
📊 Package size report 0.2%↑
Unchanged files
🤖 This report was automatically generated by pkg-size-action |
@pieh
pieh
added
the
test all versions
Run e2e tests against old and canary versions of Next.js
label
Oct 1, 2025
@pieh
pieh
force-pushed
the
feat/skew-protection
branch
from
October 1, 2025 15:08
bd48131 to
752f755
Compare
@pieh
pieh
force-pushed
the
feat/skew-protection
branch
from
October 1, 2025 15:40
752f755 to
47fb69f
Compare
pieh
pieh
commented
Oct 1, 2025
console.log('Setting up Next.js Skew Protection.')
}
process.env.NEXT_DEPLOYMENT_ID = process.env.DEPLOY_ID
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ideally instead of setting this internal Next.js env var, we could set this via next.config.js#deploymentId ( https://github.com/vercel/next.js/blob/bd727d6f19852cc7ffd44b0321fd35b5f88c55e3/packages/next/src/server/config-shared.ts#L1065-L1068 ), but for now we don't have blessed way to mutate config
@pieh
pieh
force-pushed
the
feat/skew-protection
branch
from
October 1, 2025 16:02
47fb69f to
7ba5192
Compare
mrstork
mrstork
reviewed
Oct 2, 2025
/** Absolute path to the skew protection config */
get skewProtectionConfigPath(): string {
return this.resolveFromPackagePath('.netlify/v1/skew-protection.json')
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I was thinking about the case of turning on skew protection, then disabling it in the following deploy, is that possible? Is that something that would ever be done? Currently this setting looks to be scoped to the site level rather than per deploy (like blobs is for example), so unsure of the mechanics here and whether it would take the most recent settings each time or work another way.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Skew protection is deploy-level configuration / metadata in similar way as redirects/rewrites are. It is possible to turn it off for future deploys by just not producing configuration for it.
This config file will be wiped automatically because it's part of Frameworks API which does have automatic cleanup ( ( https://github.com/netlify/build/blob/main/packages/build/src/plugins_core/pre_cleanup/index.ts ) so we don't have to ensure it doesn't exist here to handle case of turning it on and later turning it off.
Is that something that would ever be done?
I don't see a reason why one would do that, unless bugs / not handled edge cases would be uncovered in the future.
*/
siteId?: string
/**
* If set to true, instead of using CLI to deploy, we will zip the source files and trigger build from zip.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Reminder that you found ntl deploy --upload-source-zip, not sure if it would help simplify things or not though
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think I would like to try this as follow up. There are potential quirks here that this is CLI version dependent and we have cases of intentionally using older CLI versions (before that option was available). For right now this is used only for this new skew protection tests so it shouldn't cause problems, just potential future annoyance if we try to move other tests to use it as well
...e was written with it instead of inlining it again in test
mrstork
mrstork
reviewed
Oct 2, 2025
mrstork
mrstork
approved these changes
Oct 2, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.
Description
This conditionally enables skew protection. Most magic happens outside of next-runtime. It's not enabled by default. Can be enabled via feature flag or env var.
Some details:
We are providing current DEPLOY_ID via setting
NEXT_DEPLOYMENT_IDenv var, so Next.js build use it when producic static assets (i.e.htmlfiles having<script>etc tags with appended?dpl=${DEPLOY_ID}query param, browser bundles attachingX-Deployment-Idheader for server action fetches as well asnext/linknavigation fetches (next/linkhas skew protection header "only" since Next 15).Before
next@14.1.4skew protection was experimental and requires experiments enabled (this was done in e2e test fixture to make sure it works as expected in all routinely tested Next.js versions)Documentation
Added separately to docs
Tests
Added e2e test for skew protection. To make it work I also added some basic setup to use buildbot instead of CLI for deploys as currently CLI deploys can't use skew protection.
Relevant links (GitHub issues, etc.) or a picture of cute animal