docs: clarify CORS preflight handling - #4463
Closed
vittorioexp wants to merge 3 commits into
Closed
Conversation
Document that prerender and isr are mutually exclusive on the same route. Closes nitrojs#4041.
Restore lib/meta.mjs and the automd compatDate generator. Document key compatibility dates and link config to the deploy changelog. Closes nitrojs#3139.
Document that cors route rules add headers only and OPTIONS handlers are required for preflight. Closes nitrojs#2340.
|
@vittorioexp is attempting to deploy a commit to the Nitro Team on Vercel. A member of the Team first needs to authorize it. |
Contributor
📝 WalkthroughWalkthroughCompatibility metadata is now exported and rendered into documentation. Routing docs clarify CORS headers and preflight handling, while prerender/ISR documentation and inline types describe their mutually exclusive behavior. ChangesNitro documentation updates
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/1.docs/5.routing.md`:
- Around line 555-561: Update the defineHandler example in server/api/[...].ts
to handle non-OPTIONS requests explicitly: retain the empty response for
OPTIONS, and return or throw a 404 for all other methods so unmatched requests
are not treated as successful responses.
In `@docs/3.config/0.index.md`:
- Around line 81-95: Update the compatibilityDate example in the configuration
documentation to align with the stated latest-tested-date guidance, using the
latest documented date consistently for both the default and provider-specific
examples; alternatively, explicitly label the existing dates as illustrative.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 8d53bfd4-c84c-421c-838b-0006270625c0
📒 Files selected for processing (6)
automd.config.tsdocs/1.docs/5.routing.mddocs/2.deploy/0.index.mddocs/3.config/0.index.mdlib/meta.mjssrc/types/route-rules.ts
Comment on lines
+555
to
+561
| ```ts [server/api/[...].ts] | ||
| export default defineHandler((event) => { | ||
| if (event.req.method === "OPTIONS") { | ||
| return ""; | ||
| } | ||
| }); | ||
| ``` |
Contributor
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
rg -n -C3 'server/api/\[\.\.\.\]|OPTIONS|defineHandler|defineEventHandler' docs src testRepository: nitrojs/nitro
Length of output: 50371
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n## docs/1.docs/5.routing.md excerpt\n'
sed -n '540,575p' docs/1.docs/5.routing.md
printf '\n## handler return behavior references\n'
rg -n -C2 'return;|return undefined|event\.res\.status|empty 200|status.?= 200|toResponse|defineHandler\(' src docs | sed -n '1,220p'
printf '\n## runtime dispatch / route matching references\n'
rg -n -C2 'catch-all|route.*match|404|not found|No route|METHODS\.has|event\.req\.method' src/runtime src/dev docs/1.docs/5.routing.md | sed -n '1,220p'Repository: nitrojs/nitro
Length of output: 24591
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect the specific runtime code that decides what happens when a handler returns nothing.
python3 - <<'PY'
from pathlib import Path
paths = [
Path("src/runtime/internal/static.ts"),
Path("src/runtime/internal/cache.ts"),
Path("src/dev/vfs.ts"),
]
for p in paths:
if p.exists():
print(f"\n## {p}")
text = p.read_text()
for i, line in enumerate(text.splitlines(), 1):
if any(k in line for k in ["return;", "return undefined", "toResponse", "defineHandler(", "HTTPError", "status = 404", "status = 200", "METHODS.has", "event.req.method"]):
start = max(1, i - 4)
end = min(len(text.splitlines()), i + 4)
for j in range(start, end + 1):
print(f"{j}:{text.splitlines()[j-1]}")
print("---")
PYRepository: nitrojs/nitro
Length of output: 4313
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '## method-specific route suffixes in docs\n'
rg -n '\.(get|post|put|delete|patch|head|options)\.ts|OPTIONS' docs/1.docs docs/4.examples src | sed -n '1,220p'
printf '\n## catch-all routing behavior in docs\n'
sed -n '180,210p' docs/1.docs/5.routing.md
printf '\n## h3 fallback behavior references in source\n'
rg -n -C2 'return undefined|return;|toResponse\(|sendNoContent|statusText: "Not Found"|status = 404|createError' src | sed -n '1,220p'Repository: nitrojs/nitro
Length of output: 16567
Handle non-OPTIONS requests explicitly here.
server/api/[...].ts also catches unmatched GET/POST/etc. If it just falls through, those requests can return an empty 200 and mask 404s. Use a method-specific OPTIONS route, or return/throw 404 for non-OPTIONS requests.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/1.docs/5.routing.md` around lines 555 - 561, Update the defineHandler
example in server/api/[...].ts to handle non-OPTIONS requests explicitly: retain
the empty response for OPTIONS, and return or throw a 404 for all other methods
so unmatched requests are not treated as successful responses.
Source: MCP tools
Comment on lines
+81
to
+95
| Deployment providers introduce new features that Nitro presets can leverage, but some of them need to be explicitly opted into via a compatibility date. | ||
|
|
||
| Set it to latest tested date in `YYYY-MM-DD` format to leverage latest preset features. | ||
| Set it to the latest tested date in `YYYY-MM-DD` format to enable newer preset behavior. You can also set per-provider dates when a platform should move forward independently. | ||
|
|
||
| If this configuration is not provided, Nitro will use `"latest"` behavior by default. | ||
| If this configuration is not provided, Nitro uses `"latest"` behavior by default. | ||
|
|
||
| ```ts | ||
| export default defineConfig({ | ||
| compatibilityDate: "2025-01-01", | ||
| // Or per provider: | ||
| // compatibilityDate: { default: "2025-01-01", cloudflare: "2025-07-13" }, | ||
| }); | ||
| ``` | ||
|
|
||
| :read-more{to="/deploy#compatibility-date" title="Compatibility date changelog"} |
Contributor
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Align the example with the “latest tested date” guidance.
The prose recommends the latest tested date, but the example uses 2025-01-01 while the generated changelog reaches 2025-07-15. Either label the value as illustrative or update the example to avoid suggesting that users should opt out of later documented preset behavior.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/3.config/0.index.md` around lines 81 - 95, Update the compatibilityDate
example in the configuration documentation to align with the stated
latest-tested-date guidance, using the latest documented date consistently for
both the default and provider-specific examples; alternatively, explicitly label
the existing dates as illustrative.
Member
|
Closing since this is updating in next release (currently in nightly, corse rule handled by latest h3 utils and h3-rules) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #2340.
Documents that the cors route rule adds Access-Control headers but does not answer OPTIONS preflights. Adds catch-all handler and middleware examples per maintainer guidance.
Test plan
corsroute rule should auto response to preflight #2340