Skip to content

feat(browser): proxyTo helper for internal hosts - #2672

Draft
ben-reitz wants to merge 2 commits into
browser-internal-hosts/toolfrom
browser-internal-hosts/proxy-to
Draft

ben-reitz wants to merge 2 commits into
browser-internal-hosts/toolfrom
browser-internal-hosts/proxy-to

Conversation

@ben-reitz

@ben-reitz ben-reitz commented Oct 22, 2026 •

Copy link
Copy Markdown
Contributor

Summary

proxyTo(url, { headers }) forwards a host to a real site while keeping the browser on the internal hostname.

"docs.internal": {
  fetch: proxyTo("https://staging.example.com", {
    headers: { authorization: `Bearer ${this.env.STAGING_TOKEN}` }
  })
}
proxyTo
  rewrite request URL to upstream, add headers
  rewrite Location redirects back to the internal host (incl. https upstream → http redirect to itself)
  drop Set-Cookie Domain and Secure attributes

__Secure- and __Host- cookies can't work over plain http; documented.

Evidence

  • Workers browser tests: 233/233 (new: redirects, cookies, headers).
  • Deployed probe found the https→http self-redirect bug, fixed in the second commit.

Merge Danger

Door: two-way

Blast Radius: none — new export.


Stack created with GitHub Stacks CLI • Give Feedback 💬

@ben-reitz
ben-reitz added this pull request to stack #2675 October 22, 2026 15:10
@ben-reitz ben-reitz changed the title browser internal hosts/proxy to feat(browser): proxyTo helper for internal hosts Oct 22, 2026
@agent-think

agent-think Bot commented Oct 22, 2026 •

Copy link
Copy Markdown
Contributor

🟢 agents import sizes: 1 entry point changed, no growth

Entry point Exports Largest gzip change Size now
🆕 agents/browser 1 new — 36.5 KiB
Changed exports (1)
Import Gzip change Size now
🆕 agents/browser#proxyTo — 36.5 KiB
How this works

Each runtime export is bundled on its own, minified, and gzipped. Changes smaller than 100 B, or smaller than 1% and 1 KiB, are ignored. Growth over 10% or 5 KiB is marked 🔴. This report is informational and does not fail CI. The workflow artifact contains every measurement.

Compared 2c79fb8b → e0630476 · workflow run · reported by agent-think[bot]

@pkg-pr-new

pkg-pr-new Bot commented Oct 22, 2026 •

Copy link
Copy Markdown

Open in StackBlitz

agents

npm i https://pkg.pr.new/agents@2672

@cloudflare/ai-chat

npm i https://pkg.pr.new/@cloudflare/ai-chat@2672

@cloudflare/codemode

npm i https://pkg.pr.new/@cloudflare/codemode@2672

hono-agents

npm i https://pkg.pr.new/hono-agents@2672

@cloudflare/shell

npm i https://pkg.pr.new/@cloudflare/shell@2672

@cloudflare/think

npm i https://pkg.pr.new/@cloudflare/think@2672

@cloudflare/voice

npm i https://pkg.pr.new/@cloudflare/voice@2672

@cloudflare/worker-bundler

npm i https://pkg.pr.new/@cloudflare/worker-bundler@2672

commit: e063047

@ben-reitz
ben-reitz force-pushed the browser-internal-hosts/proxy-to branch from 6ddba73 to 8c84b37 Compare October 22, 2026 15:40
@changeset-bot

changeset-bot Bot commented Oct 22, 2026 •

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: e063047

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@changeset-bot

changeset-bot Bot commented Oct 22, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 8c84b37

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@ben-reitz
ben-reitz force-pushed the browser-internal-hosts/proxy-to branch from 8c84b37 to a7bad9a Compare October 22, 2026 23:08
@ben-reitz
ben-reitz force-pushed the browser-internal-hosts/proxy-to branch 2 times, most recently from 02bfc77 to 811b734 Compare October 23, 2026 10:01
@ben-reitz
ben-reitz force-pushed the browser-internal-hosts/proxy-to branch from 811b734 to 383d97a Compare October 23, 2026 10:52
@ben-reitz
ben-reitz force-pushed the browser-internal-hosts/proxy-to branch from 383d97a to 45c5d0b Compare October 23, 2026 12:29
@ben-reitz
ben-reitz force-pushed the browser-internal-hosts/proxy-to branch 3 times, most recently from 7a5b852 to d20cb33 Compare October 23, 2026 13:26
@ben-reitz
ben-reitz force-pushed the browser-internal-hosts/proxy-to branch from d20cb33 to efe5d77 Compare October 23, 2026 13:34
…itself

An https site behind a TLS-terminating proxy often redirects to its own
host over plain http (httpbin.org does). proxyTo compared origins, so the
browser left the internal host and hit guardrails. Found probing deployed
Browser Run.
@ben-reitz
ben-reitz force-pushed the browser-internal-hosts/proxy-to branch from efe5d77 to e063047 Compare October 23, 2026 13:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant