feat: support skew protection

Author: pieh

src/build/plugin-context.ts

@@ -207,6 +207,11 @@ export class PluginContext {
     return join(this.edgeFunctionsDir, EDGE_HANDLER_NAME)
   }
 
+  /** Absolute path to the skew protection config */
+  get skewProtectionConfigPath(): string {
+    return this.resolveFromPackagePath('.netlify/v1/skew-protection.json')
+  }
+
   constructor(options: NetlifyPluginOptions) {
     this.constants = options.constants
     this.featureFlags = options.featureFlags

src/build/skew-protection.ts

@@ -0,0 +1,42 @@
+import { mkdir, writeFile } from 'node:fs/promises'
+import { dirname } from 'node:path'
+
+import { PluginContext } from './plugin-context.js'
+
+export const setSkewProtection = async (ctx: PluginContext) => {
+  if (!process.env.DEPLOY_ID || process.env.DEPLOY_ID === '0') {
+    return
+  }
+
+  console.log('[Next Runtime] Setting up Next.js Skew Protection')
+
+  process.env.NEXT_DEPLOYMENT_ID = process.env.DEPLOY_ID
+
+  await mkdir(dirname(ctx.skewProtectionConfigPath), {
+    recursive: true,
+  })
+  await writeFile(
+    ctx.skewProtectionConfigPath,
+    JSON.stringify(
+      {
+        patterns: ['.*'],
+        sources: [
+          {
+            type: 'cookie',
+            name: '__vdpl',
+          },
+          {
+            type: 'header',
+            name: 'X-Deployment-Id',
+          },
+          {
+            type: 'query',
+            name: 'dpl',
+          },
+        ],
+      },
+      null,
+      2,
+    ),
+  )
+}

src/index.ts

@@ -18,6 +18,7 @@ import { clearStaleEdgeHandlers, createEdgeHandlers } from './build/functions/ed
 import { clearStaleServerHandlers, createServerHandler } from './build/functions/server.js'
 import { setImageConfig } from './build/image-cdn.js'
 import { PluginContext } from './build/plugin-context.js'
+import { setSkewProtection } from './build/skew-protection.js'
 import {
   verifyAdvancedAPIRoutes,
   verifyNetlifyFormsWorkaround,
@@ -62,6 +63,7 @@ export const onPreBuild = async (options: NetlifyPluginOptions) => {
     } else {
       await restoreBuildCache(ctx)
     }
+    await setSkewProtection(ctx)
   })
 }