Add secure option for external rewrites to support self-signed certificates

crates/next-core/src/next_config.rs

@@ -396,6 +396,8 @@ pub struct Rewrite {
     pub has: Option<Vec<RouteHas>>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub missing: Option<Vec<RouteHas>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub secure: Option<bool>,
 }
 
 #[turbo_tasks::value(eq = "manual")]

docs/01-app/05-api-reference/05-config/01-next-config-js/rewrites.mdx

@@ -42,6 +42,7 @@ Rewrites are applied to client-side routing, a `<Link href="/about">` will have
 - `destination`: `String` is the path you want to route to.
 - `basePath`: `false` or `undefined` - if false the basePath won't be included when matching, can be used for external rewrites only.
 - `locale`: `false` or `undefined` - whether the locale should not be included when matching.
+- `secure`: `boolean` or `undefined` - for external rewrites (`destination` starts with `http://` or `https://`), this controls the `secure` option passed to the underlying proxy. Defaults to `true` if undefined. Set to `false` to allow proxying to destinations with invalid or self-signed SSL certificates. _(Applies to external rewrites only)_.
 - `has` is an array of [has objects](#header-cookie-and-query-matching) with the `type`, `key` and `value` properties.
 - `missing` is an array of [missing objects](#header-cookie-and-query-matching) with the `type`, `key` and `value` properties.
 
@@ -354,11 +355,17 @@ module.exports = {
       {
         source: '/blog/',
         destination: 'https://example.com/blog/',
+        secure: true, // Optional: Defaults to true
       },
       {
         source: '/blog/:path*/',
         destination: 'https://example.com/blog/:path*/',
       },
+      {
+        source: '/local-dev/:path*',
+        destination: 'https://localhost:3001/:path*',
+        secure: false, // Example: Allow proxying to self-signed cert
+      },
     ]
   },
 }

packages/next/src/lib/load-custom-routes.ts

@@ -26,6 +26,7 @@ export type Rewrite = {
   locale?: false
   has?: RouteHas[]
   missing?: RouteHas[]
+  secure?: boolean
 
   /**
    * @internal - used internally for routing

packages/next/src/server/config-schema.ts

@@ -66,6 +66,7 @@ const zRewrite: zod.ZodType<Rewrite> = z.object({
   locale: z.literal(false).optional(),
   has: z.array(zRouteHas).optional(),
   missing: z.array(zRouteHas).optional(),
+  secure: z.boolean().optional(),
   internal: z.boolean().optional(),
 })
 

packages/next/src/server/lib/router-server.ts

@@ -353,6 +353,7 @@ export async function initialize(opts: {
         resHeaders,
         bodyStream,
         matchedOutput,
+        secure,
       } = await resolveRoutes({
         req,
         res,
@@ -428,7 +429,8 @@ export async function initialize(opts: {
           parsedUrl,
           undefined,
           getRequestMeta(req, 'clonableBody')?.cloneBodyStream(),
-          config.experimental.proxyTimeout
+          config.experimental.proxyTimeout,
+          secure
         )
       }
 
@@ -749,7 +751,7 @@ export async function initialize(opts: {
           )
         },
       })
-      const { matchedOutput, parsedUrl } = await resolveRoutes({
+      const { matchedOutput, parsedUrl, secure } = await resolveRoutes({
         req,
         res,
         isUpgradeReq: true,
@@ -763,7 +765,15 @@ export async function initialize(opts: {
       }
 
       if (parsedUrl.protocol) {
-        return await proxyRequest(req, socket, parsedUrl, head)
+        return await proxyRequest(
+          req,
+          socket,
+          parsedUrl,
+          head,
+          undefined,
+          undefined,
+          secure
+        )
       }
 
       // If there's no matched output, we don't handle the request as user's

packages/next/src/server/lib/router-utils/proxy-request.ts

@@ -12,7 +12,8 @@ export async function proxyRequest(
   parsedUrl: NextUrlWithParsedQuery,
   upgradeHead?: Buffer,
   reqBody?: any,
-  proxyTimeout?: number | null
+  proxyTimeout?: number | null,
+  secure?: boolean
 ) {
   const { query } = parsedUrl
   delete (parsedUrl as any).query
@@ -33,6 +34,7 @@ export async function proxyRequest(
     headers: {
       'x-forwarded-host': req.headers.host || '',
     },
+    secure: secure === undefined ? true : secure,
   })
 
   let finished = false

packages/next/src/server/lib/router-utils/resolve-routes.ts

@@ -119,6 +119,7 @@ export function getResolveRoutes(
     resHeaders: Record<string, string | string[]>
     parsedUrl: NextUrlWithParsedQuery
     matchedOutput?: FsOutput | null
+    secure?: boolean
   }> {
     let finished = false
     let resHeaders: Record<string, string | string[]> = {}
@@ -629,6 +630,7 @@ export function getResolveRoutes(
                   parsedUrl,
                   resHeaders,
                   finished: true,
+                  secure: (route as Rewrite).secure,
                 }
               }
 
@@ -769,6 +771,7 @@ export function getResolveRoutes(
               // @ts-expect-error custom ParsedUrl
               parsedUrl: parsedDestination,
               finished: true,
+              secure: (route as Rewrite).secure,
             }
           }