Feat/skew protection #3147
Draft
Feat/skew protection #3147
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
📊 Package size report 0.2%↑
Unchanged files
🤖 This report was automatically generated by pkg-size-action |
pieh
added
the
test all versions
pieh
force-pushed
the
feat/skew-protection
branch
from
bd48131 to
752f755
Compare
pieh
force-pushed
the
feat/skew-protection
branch
from
752f755 to
47fb69f
Compare
pieh
commented
Oct 1, 2025
| console.log('Setting up Next.js Skew Protection.') | ||
| } | ||
|
|
||
| process.env.NEXT_DEPLOYMENT_ID = process.env.DEPLOY_ID |
There was a problem hiding this comment.
Ideally instead of setting this internal Next.js env var, we could set this via next.config.js#deploymentId ( https://github.com/vercel/next.js/blob/bd727d6f19852cc7ffd44b0321fd35b5f88c55e3/packages/next/src/server/config-shared.ts#L1065-L1068 ), but for now we don't have blessed way to mutate config
pieh
force-pushed
the
feat/skew-protection
branch
from
47fb69f to
7ba5192
Compare
mrstork
reviewed
Oct 2, 2025
|
|
||
| /** Absolute path to the skew protection config */ | ||
| get skewProtectionConfigPath(): string { | ||
| return this.resolveFromPackagePath('.netlify/v1/skew-protection.json') |
There was a problem hiding this comment.
I was thinking about the case of turning on skew protection, then disabling it in the following deploy, is that possible? Is that something that would ever be done? Currently this setting looks to be scoped to the site level rather than per deploy (like blobs is for example), so unsure of the mechanics here and whether it would take the most recent settings each time or work another way.
There was a problem hiding this comment.
Skew protection is deploy-level configuration / metadata in similar way as redirects/rewrites are. It is possible to turn it off for future deploys by just not producing configuration for it.
This config file will be wiped automatically because it's part of Frameworks API which does have automatic cleanup ( ( https://github.com/netlify/build/blob/main/packages/build/src/plugins_core/pre_cleanup/index.ts ) so we don't have to ensure it doesn't exist here to handle case of turning it on and later turning it off.
Is that something that would ever be done?
I don't see a reason why one would do that, unless bugs / not handled edge cases would be uncovered in the future.
| */ | ||
| siteId?: string | ||
| /** | ||
| * If set to true, instead of using CLI to deploy, we will zip the source files and trigger build from zip. |
There was a problem hiding this comment.
Reminder that you found ntl deploy --upload-source-zip, not sure if it would help simplify things or not though
There was a problem hiding this comment.
I think I would like to try this as follow up. There are potential quirks here that this is CLI version dependent and we have cases of intentionally using older CLI versions (before that option was available). For right now this is used only for this new skew protection tests so it shouldn't cause problems, just potential future annoyance if we try to move other tests to use it as well
…e was written with it instead of inlining it again in test
mrstork
reviewed
Oct 2, 2025
mrstork
approved these changes
Oct 2, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This conditionally enables skew protection. Most magic happens outside of next-runtime. It's not enabled by default. Can be enabled via feature flag or env var.
Some details:
We are providing current DEPLOY_ID via setting
NEXT_DEPLOYMENT_IDenv var, so Next.js build use it when producic static assets (i.e.htmlfiles having<script>etc tags with appended?dpl=${DEPLOY_ID}query param, browser bundles attachingX-Deployment-Idheader for server action fetches as well asnext/linknavigation fetches (next/linkhas skew protection header "only" since Next 15).Before
[email protected]skew protection was experimental and requires experiments enabled (this was done in e2e test fixture to make sure it works as expected in all routinely tested Next.js versions)Documentation
Added separately to docs
Tests
Added e2e test for skew protection. To make it work I also added some basic setup to use buildbot instead of CLI for deploys as currently CLI deploys can't use skew protection.
Relevant links (GitHub issues, etc.) or a picture of cute animal