feat: implement x-forwarded-host header

The SSR server now uses the x-forwarded-host header to determine the URL request origin (if set). It is still overridden by the ORIGIN environment variable (if set).

The router will add the x-forwarded-host header before modifying the host header when forwarding onto the lambda URL origins.

Author: H0R5E

README.md

@@ -58,9 +58,13 @@ handler and lambda@edge router. They are defined as follows:
 ### buildServer(builder, artifactPath, esbuildOptions) ⇒ [<code>Promise.&lt;SiteProps&gt;</code>](#SiteProps)
 
 <p>Prepare SvelteKit SSR server files for deployment to AWS services.</p>
-<p>Note that the ORIGIN environment variable can be set to rewrite the URL
-request origin prior to rendering with sveltekit. This prevents CORS
-errors caused by redirects.</p>
+<p>To determine the URL request origin the server uses the following hierarchy:</p>
+<ul>
+<li>The ORIGIN environment variable</li>
+<li>The value of the 'X-Forwarded-Host' header</li>
+<li>The domain name within the request event</li>
+</ul>
+<p>The origin value is important to prevent CORS errors.</p>
 
 **Kind**: global function
 
@@ -89,6 +93,8 @@ errors caused by redirects.</p>
 ### buildRouter(builder, static_directory, prerendered_directory, serverURL, optionsURL, artifactPath) ⇒ <code>Promise.&lt;string&gt;</code>
 
 <p>Prepare lambda@edge origin router for deployment to AWS services</p>
+<p>Note that this function will forward the original Host header as
+'X-Forwarded-Host' to the lambda URLs.</p>
 
 **Kind**: global function  
 **Returns**: <code>Promise.&lt;string&gt;</code> - Location of files for the origin router

index.ts

@@ -27,9 +27,12 @@ type SiteProps = {
 /**
  * Prepare SvelteKit SSR server files for deployment to AWS services.
  *
- * Note that the ORIGIN environment variable can be set to rewrite the URL
- * request origin prior to rendering with sveltekit. This prevents CORS
- * errors caused by redirects.
+ * To determine the URL request origin the server uses the following hierarchy:
+ * + The ORIGIN environment variable
+ * + The value of the 'X-Forwarded-Host' header
+ * + The domain name within the request event
+ *
+ * The origin value is important to prevent CORS errors.
  *
  * @param {any} builder The SvelteKit provided [Builder]{@link https://kit.svelte.dev/docs/types#public-types-builder} object
  * @param {string} artifactPath The path where to place to SvelteKit files
@@ -134,6 +137,10 @@ export async function buildOptions(
 
 /**
  * Prepare lambda@edge origin router for deployment to AWS services
+ *
+ * Note that this function will forward the original Host header as
+ * 'X-Forwarded-Host' to the lambda URLs.
+ *
  * @param {any} builder The SvelteKit provided [Builder]{@link https://kit.svelte.dev/docs/types#public-types-builder} object
  * @param {string} static_directory location of static page files
  * @param {string} prerendered_directory location of prerendered page files

lambda/router.js

@@ -76,6 +76,12 @@ async function performReWrite(uri, request, target) {
       customHeaders: {},
     },
   }
+  request.headers['x-forwarded-host'] = [
+    {
+      key: 'X-Forwarded-Host',
+      value: request.headers['host'][0].value,
+    },
+  ]
   request.headers['host'] = [{ key: 'host', value: domainName }]
 
   const searchParams = new URLSearchParams(request.querystring)

lambda/serverless.js

@@ -23,10 +23,13 @@ export async function handler(event, context) {
     headers['cookie'] = cookies.join('; ')
   }
 
+  const domainName =
+    'x-forwarded-host' in headers
+      ? headers['x-forwarded-host']
+      : requestContext.domainName
+
   const origin =
-    'ORIGIN' in process.env
-      ? process.env['ORIGIN']
-      : `https://${requestContext.domainName}`
+    'ORIGIN' in process.env ? process.env['ORIGIN'] : `https://${domainName}`
 
   let rawURL = `${origin}${rawPath}${
     rawQueryString ? `?${rawQueryString}` : ''