Skip to content

feat: skew protection #3147

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 12 commits into from
Oct 14, 2025
Merged

feat: skew protection #3147

Show file tree
Hide file tree
Changes from 9 commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
ece4338
test: setup for skew protection e2e tests and first test (server acti…
pieh Sep 18, 2025
7ba5192
feat: support skew protection
pieh Sep 11, 2025
a68962a
Merge remote-tracking branch 'origin/main' into feat/skew-protection
pieh Oct 2, 2025
fae7557
test: use enums in tests and not string values
pieh Oct 2, 2025
92cfc9a
test: export skew protection config and assert that configuration fil…
pieh Oct 2, 2025
edaa88f
refactor: use early bails in logic deciding wether to enable skew pro…
pieh Oct 2, 2025
b2f9883
test: group env var enablement/disablement tests
pieh Oct 2, 2025
9239542
test: skip building skew protection fixture for integration tests
pieh Oct 2, 2025
3282023
Merge branch 'main' into feat/skew-protection
pieh Oct 8, 2025
51d6b74
test: set empty turbopack in config for webpack/turbopack compat
pieh Oct 8, 2025
00fa952
Merge remote-tracking branch 'origin/main' into feat/skew-protection
pieh Oct 13, 2025
cb190f3
Merge branch 'main' into feat/skew-protection
pieh Oct 14, 2025
File filter

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 37 additions & 0 deletions package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 2 additions & 0 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,10 +65,12 @@
"@netlify/zip-it-and-ship-it": "^14.1.8",
"@opentelemetry/api": "^1.8.0",
"@playwright/test": "^1.43.1",
"@types/adm-zip": "^0.5.7",
"@types/node": "^20.12.7",
"@types/picomatch": "^3.0.0",
"@types/uuid": "^10.0.0",
"@vercel/nft": "^0.30.0",
"adm-zip": "^0.5.16",
"cheerio": "^1.0.0-rc.12",
"clean-package": "^2.2.0",
"esbuild": "^0.25.0",
Expand Down
5 changes: 5 additions & 0 deletions src/build/plugin-context.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -207,6 +207,11 @@ export class PluginContext {
return join(this.edgeFunctionsDir, EDGE_HANDLER_NAME)
}

/** Absolute path to the skew protection config */
get skewProtectionConfigPath(): string {
return this.resolveFromPackagePath('.netlify/v1/skew-protection.json')
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was thinking about the case of turning on skew protection, then disabling it in the following deploy, is that possible? Is that something that would ever be done? Currently this setting looks to be scoped to the site level rather than per deploy (like blobs is for example), so unsure of the mechanics here and whether it would take the most recent settings each time or work another way.
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Skew protection is deploy-level configuration / metadata in similar way as redirects/rewrites are. It is possible to turn it off for future deploys by just not producing configuration for it.

This config file will be wiped automatically because it's part of Frameworks API which does have automatic cleanup ( ( https://github.com/netlify/build/blob/main/packages/build/src/plugins_core/pre_cleanup/index.ts ) so we don't have to ensure it doesn't exist here to handle case of turning it on and later turning it off.

Is that something that would ever be done?

I don't see a reason why one would do that, unless bugs / not handled edge cases would be uncovered in the future.
}

constructor(options: NetlifyPluginOptions) {
this.constants = options.constants
this.featureFlags = options.featureFlags
Expand Down
Loading
Loading