Skip to content

fix: preserve HTTPS/HTTP2 host port in @cloudflare/vite-plugin requests - #14933

Open
intrdx wants to merge 4 commits into
cloudflare:mainfrom
intrdx:fix/vite-plugin-https-http2-host-port
Open

fix: preserve HTTPS/HTTP2 host port in @cloudflare/vite-plugin requests#14933
intrdx wants to merge 4 commits into
cloudflare:mainfrom
intrdx:fix/vite-plugin-https-http2-host-port

Conversation

@intrdx

@intrdx intrdx commented Jul 30, 2026

Copy link
Copy Markdown

Fixes #14931.

Preserve host and non-default port from Host / :authority when constructing Vite HTTPS/HTTP2 requests in @cloudflare/vite-plugin.

Under HTTPS, Vite uses HTTP/2. Pseudo-headers like :authority are skipped when building Fetch headers, so Host can be missing and host resolution falls back to localhost without :5173. Auth libraries like Clerk then build handshake redirect_url / X-Forwarded-Host from that broken origin and loop.

This change:

  • Resolves host from req.headers.host then :authority
  • Passes it into createRequest as options.host
  • Sets Host when missing so existing X-Forwarded-Host logic keeps e.g. localhost:5173

Validated locally with an equivalent pnpm patch against @cloudflare/vite-plugin@1.45.1 (Clerk handshake no longer drops :5173 port under HTTPS).

Related: #8684 / #8706, #10884, #13801 / #13920


  • Tests
    • Tests included/updated
    • Manual testing has been completed as follows:
      • Vite server.https (mkcert) + --host
      • Open https://localhost:5173 with Clerk middleware
      • Confirm handshake Location / redirect_url keeps :5173 (no redirect loop to https://localhost/)
      • Confirm HTTP http://localhost:5173 still works
  • Public documentation
    • Documentation not necessary because: bug fix restoring correct request origin/port behavior; no new public API

Open in Devin Review

@intrdx
intrdx requested a review from workers-devprod as a code owner July 30, 2026 11:03
@changeset-bot

changeset-bot Bot commented Jul 30, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 3c38904

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
@cloudflare/vite-plugin Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@workers-devprod
workers-devprod requested review from a team and NuroDev and removed request for a team July 30, 2026 11:04
@workers-devprod

workers-devprod commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

Codeowners approval required for this PR:

  • ✅ @cloudflare/wrangler
Show detailed file reviewers

devin-ai-integration[bot]

This comment was marked as resolved.

devin-ai-integration[bot]

This comment was marked as resolved.

devin-ai-integration[bot]

This comment was marked as resolved.

Co-authored-by: Cursor <cursoragent@cursor.com>
@intrdx
intrdx force-pushed the fix/vite-plugin-https-http2-host-port branch from f42939d to 7db27e5 Compare July 30, 2026 11:47
@pkg-pr-new

pkg-pr-new Bot commented Aug 3, 2026

Copy link
Copy Markdown
@cloudflare/autoconfig

npm i https://pkg.pr.new/@cloudflare/autoconfig@14933

@cloudflare/config

npm i https://pkg.pr.new/@cloudflare/config@14933

create-cloudflare

npm i https://pkg.pr.new/create-cloudflare@14933

@cloudflare/deploy-helpers

npm i https://pkg.pr.new/@cloudflare/deploy-helpers@14933

@cloudflare/kv-asset-handler

npm i https://pkg.pr.new/@cloudflare/kv-asset-handler@14933

miniflare

npm i https://pkg.pr.new/miniflare@14933

@cloudflare/pages-functions

npm i https://pkg.pr.new/@cloudflare/pages-functions@14933

@cloudflare/pages-shared

npm i https://pkg.pr.new/@cloudflare/pages-shared@14933

@cloudflare/unenv-preset

npm i https://pkg.pr.new/@cloudflare/unenv-preset@14933

@cloudflare/vite-plugin

npm i https://pkg.pr.new/@cloudflare/vite-plugin@14933

@cloudflare/vitest-pool-workers

npm i https://pkg.pr.new/@cloudflare/vitest-pool-workers@14933

@cloudflare/workers-auth

npm i https://pkg.pr.new/@cloudflare/workers-auth@14933

@cloudflare/workers-editor-shared

npm i https://pkg.pr.new/@cloudflare/workers-editor-shared@14933

@cloudflare/workers-utils

npm i https://pkg.pr.new/@cloudflare/workers-utils@14933

wrangler

npm i https://pkg.pr.new/wrangler@14933

commit: e7c85a3

@NuroDev NuroDev left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overall this looks good to me @intrdx
Though it looks like CI tests are failing and need fixing. Once those are fixed we can get this merged.

@workers-devprod workers-devprod left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Codeowners reviews satisfied

@github-project-automation github-project-automation Bot moved this from Untriaged to Approved in workers-sdk Aug 3, 2026
createHeaders reads rawHeaders, so always set Host from host/:authority and mutate rawHeaders in tests that simulate HTTP/2 or a custom Host.

Co-authored-by: Cursor <cursoragent@cursor.com>
@intrdx

intrdx commented Aug 3, 2026

Copy link
Copy Markdown
Author

Thanks @NuroDev, Pushed a fix for the host/port tests, could you approve the workflows?, so i can check.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Approved

Development

Successfully merging this pull request may close these issues.

@cloudflare/vite-plugin: HTTPS/HTTP2 Host/:authority handling drops non-default port from request.url (breaks Clerk handshake redirects)

3 participants