feat(pro-327): forward client IP to origin via clientIpHeader KVS entry - #5
Open
alistairsmith-tech wants to merge 1 commit into
Open
feat(pro-327): forward client IP to origin via clientIpHeader KVS entry#5alistairsmith-tech wants to merge 1 commit into
alistairsmith-tech wants to merge 1 commit into
Conversation
When the clientIpHeader KVS entry is set (written by the web deploy flow), the viewer-request function stamps event.viewer.ip under that header name immediately after acquiring the KVS handle, so every origin-bound pass-through path (valid cookie, unprotected path, no-secret fail-open, and the outer catch) carries it. Edge trust boundary: always overwritten, and removed when no viewer IP is available, so an inbound client-supplied value can never reach the origin as a spoofed identity. No behavior change when the entry is absent. Stripped artifact: 10043 of 10240 bytes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Plugin half of the SFCC client-IP header feature (PRO-327, part of the PRO-316 stacked-CDN work; the web deploy flow already writes a
clientIpHeaderKVS entry that the current function ignores).clientIpHeaderfrom the KVS right after acquiring the handle and, when present, stampsevent.viewer.ipunder that (lowercased) header name on the request object, so every origin-bound pass-through path carries it: valid-cookie, unprotected-path, no-cookie-secret fail-open, and the outer fail-open catch (the stamp happens before anything that can throw). The/__mcl/verifyreturn deliberately precedes it: that behavior is answered by the Lambda and never reaches the origin.build.mjsenforces the cap and passes.Tests
Five new cases: overwrite of a forged value on the valid-cookie path, stamping on the unprotected-path and no-secret fail-open paths, removal when no viewer IP is available, and untouched headers when the entry is absent. Full suite: 55/55 passing. (Pre-existing
strip.mjsTS7016 on main is untouched.)Release notes
After merge: tag a release, bump
MONOCLE_CLOUDFRONT_PLUGIN_VERSIONin web, redeploy SFCC apps (function republish + distribution propagation takes minutes per app).🤖 Generated with Claude Code