Adjust approach for prerendering/SPA mode via headers

[brophdawg11]

No description provided.

[changeset-bot]

🦋 Changeset detected

Latest commit: 1694cae

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 11 packages

Name	Type
@react-router/dev	Patch
react-router	Patch
@react-router/fs-routes	Patch
@react-router/remix-routes-option-adapter	Patch
@react-router/architect	Patch
@react-router/cloudflare	Patch
react-router-dom	Patch
@react-router/express	Patch
@react-router/node	Patch
@react-router/serve	Patch
create-react-router	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

🤖 Hello there,

We just published version 7.5.2 which includes this pull request. If you'd like to take it for a test run please try it out and let us know what you think!

Thanks!

[breadadams]

Hey @brophdawg11, are there any plans to backport this to v6?

[labkey-nicka]

Hey @brophdawg11, are there any plans to backport this to v6?

More so, does this even apply to v6? Doing a rough search of the v6 branch it does not contain X-React-Router-SPA-Mode. If it does not, then could the GHSA-f46r-rw29-r322 security advisory be updated to reflect affected versions more accurately?

[kirbysayshi]

@brophdawg11

More so, does this even apply to v6? Doing a rough search of the v6 branch it does not contain X-React-Router-SPA-Mode. If it does not, then could the GHSA-f46r-rw29-r322 security advisory be updated to reflect affected versions more accurately?

I just did my own investigation that I shared on Discord and wanted to share. We're on Remix, and I don't see any of the affected code in Remix or react-router v6. For now we've ignored the two advisories...

• GHSA-f46r-rw29-r322
• GHSA-cpj6-fhp6-mr6j

... but I'd love to have the advisories themselves amended to only target react-router >= 7 <= 7.5.1 to save someone else still on Remix the trouble. I spent an hour or two verifying this, I'd like to save others the time!

[brophdawg11]

Hey folks - this is not an issue in React Router v6 or below (and therefore is not an issue in Remix v2). We forgot to include the lower bound in the "affected" field of the advisory. I've updated both with proper lower bounds but they are as follows:

• Prerender data spoofing: >= 7.0, <= 7.5.1
• SPA Mode Cache Poisoning: >= 7.2.0, <= 7.5.1