feat(netlify): verification for edge middleware

[lilnasy]

Changes

• Ensures that when edgeMiddleware is enabled, only the edge middleware can call the internal serverless function.

Testing

Manual

Docs

• document new behavior(vercel, netlify): edge middleware verification docs#6786

[changeset-bot]

🦋 Changeset detected

Latest commit: 4ac43a5

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
@astrojs/netlify	Minor
@test/netlify-hosted-astro-project	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[lilnasy]

!preview edge-middleware-verification

[github-actions]

Snapshots have been released for the following packages:

• @astrojs/netlify@experimental--edge-middleware-verification

Publish Log

🦋  warn ===============================IMPORTANT!===============================
🦋  warn Packages will be released under the experimental--edge-middleware-verification tag
🦋  warn ----------------------------------------------------------------------
🦋  info npm info @astrojs/cloudflare
🦋  info npm info @astrojs/netlify
🦋  warn @astrojs/cloudflare is not being published because version 9.0.0 is already published on npm
🦋  info @astrojs/netlify is being published because our local version (0.0.0-edge-middleware-verification-20240205170200) has not been published on npm
🦋  info Publishing "@astrojs/netlify" at "0.0.0-edge-middleware-verification-20240205170200"
🦋  success packages published successfully:
🦋  @astrojs/netlify@0.0.0-edge-middleware-verification-20240205170200
🦋  Creating git tag...
🦋  New tag:  @astrojs/netlify@0.0.0-edge-middleware-verification-20240205170200

Build Log

> root@0.0.0 build /home/runner/work/adapters/adapters
> turbo run build --filter="@astrojs/*"

• Packages in scope: @astrojs/cloudflare, @astrojs/netlify, @astrojs/test-utils
• Running build in 3 packages
• Remote caching disabled
::group::@astrojs/netlify:build
cache miss, executing f45dadaafc342c58

> @astrojs/netlify@0.0.0-edge-middleware-verification-20240205170200 build /home/runner/work/adapters/adapters/packages/netlify
> tsc

::endgroup::
::group::@astrojs/cloudflare:build
cache miss, executing 04ab7c5839174536

> @astrojs/cloudflare@9.0.0 build /home/runner/work/adapters/adapters/packages/cloudflare
> tsc

::endgroup::

 Tasks:    2 successful, 2 total
Cached:    0 cached, 2 total
  Time:    4.22s 

[Skn0tt]

This is a risky change, and it's not obvious to me what attack vector this protects against. Could you outline that, either here or via email if you feel like it's too sensitive?

[lilnasy]

This is motivated by the clerk vulnerability.

• Investigating a major security vulnerability with Clerk's Next.js integration
• Clerk January 2024 Vulnerability Update

[Skn0tt]

Got it, thanks! That looks like a spooky vuln definitely o.O

My understanding of the PR is that you want to ensure that the SSR function can only be reached via the Middleware, if there's a middleware configured. I don't think that attack vector exists currently, because the middleware is configured to run on all requests (except for the requests to Image CDN and static assets):

adapters/packages/netlify/src/index.ts

Line 148 in 7a5c3b0

path: "/*", excludedPath: ["/_astro/*", "/.netlify/images/*"]

So there's no way of circumventing the Middleware function. We're already ensuring this works as expected inside of the CDN, I don't think we need another check in the adapter on top of that. Am I missing something here?

[lilnasy]

Yeah, looks like Netlify gives us a guard rail, which is great. It would be even better to have a safety net on top of it.

[Skn0tt]

Your call! If the behaviour is the same across all adapters, then it's fine I guess.

[lilnasy]

@Skn0tt I have added you to a private thread in the #netlify channel of the astro discord. You might want to take that into account as well.

[alexanderniebuhr]

Pretty sure the changeset is good, but let's have docs take a look ;)

[sarah11918]

Changeset looks great!! 💪