fix(cockpit): accept the platform slash collapse for the consecutive-slash raw canary - #987
Merged
Merged
Conversation
…slash raw canary
With the cockpit bypass secret in place, the exhaustive preview smoke ran
against the immutable artifact for the first time and stopped on its first
raw canary:
[preview] raw malformed 1: //langgraph/...: expected 404, received 308.
Vercel's CDN collapses consecutive slashes and answers 308 to the
single-slash path on the same origin before any route, rewrite, or function
runs, and there is no setting to turn that off. The 404 route in
vercel.cockpit.json therefore never sees a `//` request; it does reject the
other seven raw targets, all verified live. The "WAF Raw Path prerequisite"
the hint named does not exist.
The consecutive-slash canary now accepts exactly one non-404 answer: a 308
whose Location resolves to the same-origin single-slash path. A redirect
off the deployment from a malformed path, or a normalization of any other
raw target, is still a contract failure. The hint now points at the real
prerequisite, the vercel.cockpit.json route.
Verified live with the bypass: pass:preview:<immutable artifact>:399.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
VERCEL_COCKPIT_AUTOMATION_BYPASS_SECRETnow exists (Protection Bypass for Automation enabled on threadplane-cockpit, value stored as the repository secret). With it, the 399-case preview smoke ran against the immutable cockpit artifact for the first time and stopped on its first raw canary:Vercel's CDN collapses consecutive slashes and answers
308to the single-slash path on the same origin before any route, rewrite, or function runs, and there is no setting to disable it (Vercel redirects, vercel/vercel#3086). The 404 route invercel.cockpit.jsontherefore never sees a//request. It does reject the other seven raw targets; all verified live against the artifact.The "WAF Raw Path prerequisite" the failure hint named does not exist anywhere in the repo or in Vercel.
Ninth push-only failure path in this arc.
Change
308whoseLocation(the platform sends it relative) resolves to the same-origin single-slash path. A redirect off the deployment from a malformed path, or a normalization of any other raw target, is still a contract failure.vercel.cockpit.json404 route must keep preceding framework routing.Verification
deploy-smoke.spec.ts+vercel-config.spec.ts: 15/15, including the accepted relative and absolute same-origin forms, rejection of a website-bound//redirect, and rejection of a normalized/./probe.pass:preview:https://threadplane-cockpit-e44mjjj5q-cacheplane.vercel.app:399.🤖 Generated with Claude Code