fix(vercel): use SameSite=Lax for skew protection cookie

[thribhuvan003]

🔗 Linked issue

fixes #4414

❓ Type of change

• 📖 Documentation (updates to the documentation, readme, or JSdoc annotations)
• 🐞 Bug fix (a non-breaking change that fixes an issue)
• 👌 Enhancement (improving an existing functionality like performance)
• ✨ New feature (a non-breaking change that adds functionality)
• 🧹 Chore (updates to the build process or auxiliary tools and libraries)
• ⚠️ Breaking change (fix or feature that would cause existing functionality to change)

📚 Description

skew pin cookie was SameSite=Strict, so after coming in from another site the html refreshed but /_nuxt assets still had the old __vdpl and 404'd. switched to Lax so the pin updates with the document. still Secure + HttpOnly.

unit test on the generated set-cookie — fails with Strict, passes with Lax.

📝 Checklist

• I have linked an issue or discussion.
• I have updated the documentation accordingly.
• I have updated the tests accordingly.

[vercel]

@thribhuvan003 is attempting to deploy a commit to the Nitro Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

📝 Walkthrough

Walkthrough

The Vercel skew protection rule changes the __vdpl cookie’s SameSite attribute from Strict to Lax.

Changes

Vercel skew protection

Layer / File(s)	Summary
Build configuration and cookie behavior src/presets/vercel/utils.ts	The __vdpl Set-Cookie header now uses SameSite=Lax instead of SameSite=Strict.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The change matches #4414 by switching __vdpl from Strict to Lax to fix cross-site asset 404s.
Out of Scope Changes check	✅ Passed	No out-of-scope changes are evident; the diff stays focused on the skew protection cookie.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The title follows conventional commits syntax and accurately reflects the Vercel cookie SameSite change.
Description check	✅ Passed	The description clearly matches the cookie fix and mentions the related test update.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

test/unit/vercel-skew.test.ts (1)

45-51: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Consider adding an edge case for skewProtection enabled but deploymentId missing.

The implementation guards with nitro.options.vercel?.skewProtection && nitro.options.manifest?.deploymentId — when deploymentId is undefined the route is skipped. A test covering this case would prevent regressions if the guard condition is ever modified.

♻️ Suggested additional test

   it("does not emit __vdpl route when skew protection is off", () => {
     const config = generateBuildConfig(mockNitro({ skewProtection: false }));
     const skewRoute = config.routes?.find(
       (r: any) => r.headers?.["Set-Cookie"]?.includes("__vdpl=")
     );
     expect(skewRoute).toBeUndefined();
   });
+
+  it("does not emit __vdpl route when deploymentId is missing", () => {
+    const config = generateBuildConfig(
+      mockNitro({ skewProtection: true, deploymentId: undefined })
+    );
+    const skewRoute = config.routes?.find(
+      (r: any) => r.headers?.["Set-Cookie"]?.includes("__vdpl=")
+    );
+    expect(skewRoute).toBeUndefined();
+  });
 });

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/unit/vercel-skew.test.ts` around lines 45 - 51, Add a test alongside
“does not emit __vdpl route when skew protection is off” covering skewProtection
enabled with no deploymentId in the mock Nitro configuration, and assert that
generateBuildConfig produces no route whose Set-Cookie header includes
"__vdpl=". Use the existing mockNitro and route lookup pattern.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@test/unit/vercel-skew.test.ts`:
- Around line 45-51: Add a test alongside “does not emit __vdpl route when skew
protection is off” covering skewProtection enabled with no deploymentId in the
mock Nitro configuration, and assert that generateBuildConfig produces no route
whose Set-Cookie header includes "__vdpl=". Use the existing mockNitro and route
lookup pattern.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: b5570675-3a3a-4e03-8602-91d39e2eac08

📥 Commits

Reviewing files that changed from the base of the PR and between a2eb28a and 60cb671.

📒 Files selected for processing (2)

• src/presets/vercel/utils.ts
• test/unit/vercel-skew.test.ts

[pi0]

LGTM, however this is diverging from sveltekit and vercel docs. keeping open little bit more. /cc @danielroe

[danielroe]

❤️

i would remove the llm generated test as i'm not sure it's that helpful, btw

[danielroe]

i think Lax is the more correct option

cc: @elliott-with-the-longest-name-on-github