[WIP] Add support for skew protection #746

vicb · 2025-06-20T12:59:38Z

There are 2 main files in this PR:

packages/cloudflare/src/cli/commands/skew-protection.ts (build time)

This builds a mapping from deploymentId to the worker version at build time.
Note that because the worker you are building has no version yet, "current" is used instead.

packages/cloudflare/src/cli/templates/skew-protection.ts (runtime)

At runtime, if a particular version is requested and it is present in the mapping,
we'll fetch the result from a preview URL with a hostname of <version>-<worker_name>.<domain>.workers.dev

How to use it:

set cloudflare.skewProtectionEnabled to true in your OpenNext config
provide values for the new env vars added to packages/cloudflare/src/api/cloudflare-context.ts
update your next config to set the deployementId - you can use the getDeploymentId() helper
set run_worker_first to true

Docs PR opennextjs/docs#164

TODO:

add tests
handle assets (will need to run the worker before the asset worker)
follow-up: move the skew protection logic in the aws/routing layer with pluggable overrides

changeset-bot · 2025-06-20T12:59:41Z

⚠️ No Changeset found

Latest commit: 468cd0a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

pkg-pr-new · 2025-06-20T13:00:32Z

Open in StackBlitz

npm i https://pkg.pr.new/@opennextjs/cloudflare@746

commit: 43be1dd

conico974

I just took a really quick look for now, will make a proper review later

packages/cloudflare/src/cli/templates/skew-protection.ts

james-elicx

I think this is looking pretty good on my initial read though. Going to have another look later on as well.

packages/cloudflare/src/cli/commands/skew-protection.ts

james-elicx

I think this looks good and the logic makes sense to me.

It might be nice for us to look at having an e2e that runs against a deployment at some point in the future, for testing features like this.

packages/cloudflare/src/cli/build/open-next/compile-skew-protection.ts

sommeeeer

LGTM

packages/cloudflare/src/cli/commands/skew-protection.ts

packages/cloudflare/src/cli/templates/skew-protection.ts

vicb · 2025-06-24T16:33:29Z

Thanks for the review @sommeeeer !

conico974

Just a few nits/question, other than that LGTM

packages/cloudflare/src/cli/build/open-next/compile-skew-protection.spec.ts

conico974 · 2025-06-24T20:13:08Z

packages/cloudflare/src/cli/build/open-next/compile-skew-protection.ts

+ * @param paths The list of path
+ * @returns The root node of the tree
+ */
+export function filesToTree(paths: string[]): FolderNode {


I think in the future here, we should create glob pattern whenever we can to avoid having a too big FolderNode . This could grow quite big if people have a lot of assets

I'll create a follow up issue for that.

packages/cloudflare/src/cli/build/open-next/compile-skew-protection.ts

conico974 · 2025-06-24T20:20:01Z

packages/cloudflare/src/cli/commands/helpers.ts

+ * @param options Options to pass to `getPlatformProxy`, i.e. to set the environment
+ * @returns the env vars
+ */
+export async function getEnvFromPlatformProxy(options: GetPlatformProxyOptions) {


I think we should have only one instance of this, that we spawn at the beginning and that we dispose at the end. It's a bit wasteful to launch multiple workerd process.
And once we have support for remote bindings here, we could reuse it to populate the cache directly (which should be way faster)

conico974 · 2025-06-24T20:23:25Z

packages/cloudflare/src/cli/commands/skew-protection.ts

+		client,
+		accountId,
+		afterTimeMs = new Date().getTime() - MAX_VERSION_AGE_DAYS * 24 * 3600 * 1000,
+		maxNumberOfVersions = MAX_NUMBER_OF_VERSIONS,


I think this one should be overridable

conico974 · 2025-06-24T20:32:58Z

packages/cloudflare/src/cli/templates/skew-protection.ts

+		path = path.slice(basePath.length);
+	}
+	if (path.startsWith("/_next/static/") || isFileInTree(path, __CF_ASSETS_TREE__)) {
+		return assets.fetch(request);


Does this one respect the _headers file ?

It should but I'll test that

Actually it doesn't, see https://developers.cloudflare.com/workers/static-assets/headers/#custom-headers

…ction.ts Co-authored-by: conico974 <nicodorseuil@yahoo.fr>

See opennextjs/opennextjs-aws#917

vicb force-pushed the vicb/skew-protection branch from 2356748 to 0a6f2dd Compare June 20, 2025 13:11

vicb requested review from conico974, james-elicx, dario-piotrowicz and sommeeeer and removed request for conico974 June 20, 2025 13:11

vicb force-pushed the vicb/skew-protection branch from 0a6f2dd to 18ba05a Compare June 20, 2025 13:14

vicb requested a review from IgorMinar June 20, 2025 13:26

conico974 reviewed Jun 20, 2025

View reviewed changes

packages/cloudflare/src/cli/templates/skew-protection.ts Outdated Show resolved Hide resolved

james-elicx reviewed Jun 20, 2025

View reviewed changes

packages/cloudflare/src/cli/commands/skew-protection.ts Outdated Show resolved Hide resolved

james-elicx approved these changes Jun 22, 2025

View reviewed changes

vicb force-pushed the vicb/skew-protection branch 4 times, most recently from 4c21542 to 471111c Compare June 23, 2025 12:13

vicb mentioned this pull request Jun 24, 2025

[Blocked by release] docs(cloudflare): skew protection opennextjs/docs#164

Open

vicb changed the title ~~[Preview] Add support for skew protection~~ Add support for skew protection Jun 24, 2025

sommeeeer reviewed Jun 24, 2025

View reviewed changes

packages/cloudflare/src/cli/build/open-next/compile-skew-protection.ts Outdated Show resolved Hide resolved

sommeeeer reviewed Jun 24, 2025

View reviewed changes

packages/cloudflare/src/cli/build/open-next/compile-skew-protection.ts Outdated Show resolved Hide resolved

sommeeeer approved these changes Jun 24, 2025

View reviewed changes

packages/cloudflare/src/cli/commands/skew-protection.ts Show resolved Hide resolved

packages/cloudflare/src/cli/templates/skew-protection.ts Outdated Show resolved Hide resolved

sommeeeer approved these changes Jun 24, 2025

View reviewed changes

conico974 approved these changes Jun 24, 2025

View reviewed changes

vicb added 4 commits June 30, 2025 14:31

Add support for skew protection

0c1542d

fixup! add test

f9c5b53

fixup! add asset handling

d4d2d18

fixup! minor

7a3a78a

vicb and others added 3 commits June 30, 2025 14:31

fixup! address review feedback

1be7b26

Update packages/cloudflare/src/cli/build/open-next/compile-skew-prote…

5906b89

…ction.ts Co-authored-by: conico974 <nicodorseuil@yahoo.fr>

fixup! prepare for the assetResolver

45edc9f

See opennextjs/opennextjs-aws#917

vicb force-pushed the vicb/skew-protection branch from 2f1f47b to 45edc9f Compare June 30, 2025 12:50

vicb added 2 commits June 30, 2025 14:52

fixup! remove unused tests

468cd0a

fixup! ability to customize nb of versions and their max age

43be1dd

vicb changed the title ~~Add support for skew protection~~ [WIP] Add support for skew protection Jul 4, 2025

[WIP] Add support for skew protection #746

Are you sure you want to change the base?

[WIP] Add support for skew protection #746

Conversation

vicb commented Jun 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot bot commented Jun 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

pkg-pr-new bot commented Jun 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

conico974 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

james-elicx left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

james-elicx left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

sommeeeer left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

vicb commented Jun 24, 2025

Uh oh!

conico974 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

conico974 Jun 24, 2025

Choose a reason for hiding this comment

Uh oh!

vicb Jun 25, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

conico974 Jun 24, 2025

Choose a reason for hiding this comment

Uh oh!

conico974 Jun 24, 2025

Choose a reason for hiding this comment

Uh oh!

conico974 Jun 24, 2025

Choose a reason for hiding this comment

Uh oh!

vicb Jun 25, 2025

Choose a reason for hiding this comment

Uh oh!

vicb Jun 30, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

vicb commented Jun 20, 2025 •

edited

Loading

changeset-bot bot commented Jun 20, 2025 •

edited

Loading

pkg-pr-new bot commented Jun 20, 2025 •

edited

Loading