Repository navigation
Conversation
Keep mockhttp.org on the Cloudflare Worker and send a sticky 10% of dynamic requests to mockhttp.wasmer.app after the edge rate limit. Co-authored-by: Jared Wray <me@jaredwray.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![aikido-pr-checks[bot]](https://avatars.githubusercontent.com/in/898896?s=60&v=4){kind=small}
Resolve the conflict in site/docs/hosted.md: keep this branch's description of the 10% Wasmer traffic split and add main's link to the Wasmer Edge deploy guide. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014wUSAto7jX3BKVDSm5YaJE
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4d747fdb54
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if (env.WASMER_EDGE_TOKEN) { | ||
| headers.set(EDGE_TOKEN_HEADER, env.WASMER_EDGE_TOKEN); |
There was a problem hiding this comment.
When WASMER_EDGE_TOKEN is configured as instructed, this adds the shared secret to the ordinary Fastify request headers. Endpoints such as /get, /headers, and /anything return request.headers, so any client routed to Wasmer receives the secret in its response. The client can then call the public Wasmer app directly with that token and arbitrary x-mockhttp-client-ip values, defeating the per-client rate limit by rotating the claimed IP. The authentication value must be removed before route handlers can observe the headers, or conveyed through a mechanism that echo endpoints cannot expose.
Useful? React with 👍 / 👎.
| return true; | ||
| } | ||
|
|
||
| return trafficBucket(clientIp(request)) < percent; |
There was a problem hiding this comment.
Hashing only the caller IP breaks request bins whenever the client creating or inspecting a bin and the webhook sender fall into different buckets. For example, a POST /bins routed to Wasmer stores the bin in that process's InMemoryBinStore, but a later /b/:id request from a Worker-bucket IP is dispatched to the separate Worker store and returns bin_not_found; the reverse direction fails similarly. This is a normal webhook-debugging flow involving two clients, so bin management and capture routes need backend affinity based on the bin itself, or they must remain on a single backend.
Useful? React with 👍 / 👎.
| if (redirected.hostname !== origin.hostname) { | ||
| return response; | ||
| } | ||
|
|
||
| redirected.protocol = incoming.protocol; | ||
| redirected.host = incoming.host; | ||
| const headers = new Headers(response.headers); | ||
| headers.set("location", redirected.toString()); |
There was a problem hiding this comment.
For a proxied request such as /redirect-to?url=https://mockhttp.wasmer.app/target, the route intentionally returns that exact user-supplied destination, but this hostname check treats it as an internal self-redirect and rewrites it to https://mockhttp.org/target. The same mutation affects user-generated Location headers from response-inspection endpoints and also matches a configured origin on the same hostname but a different port. Restrict rewriting to redirects known to have been generated as internal links rather than rewriting every response whose Location happens to share the upstream hostname.
Useful? React with 👍 / 👎.
| redirected.protocol = incoming.protocol; | ||
| redirected.host = incoming.host; | ||
| const headers = new Headers(response.headers); | ||
| headers.set("location", redirected.toString()); |
There was a problem hiding this comment.
When /absolute-redirect/:value is handled by Wasmer, that route constructs both its Location header and its HTML link from the Wasmer request host. This function rewrites only Location, so the returned HTML still links to mockhttp.wasmer.app even though the header points to mockhttp.org; this violates the endpoint's existing contract that the body link and redirect target match for every client in the Wasmer cohort. The public origin needs to reach the route itself, or the matching link in the body must be rewritten too.
Useful? React with 👍 / 👎.
| const forwarded = firstHeader(request.headers["x-forwarded-host"]); | ||
| if (forwarded && ALLOWED_FORWARDED_HOSTS.has(hostnameOf(forwarded))) { | ||
| return hostnameOf(forwarded); |
There was a problem hiding this comment.
When the public service is reached on a non-default port, such as https://mockhttp.org:8443, the Worker forwards mockhttp.org:8443, but this returns only the parsed hostname. Consequently /bins, /delay, and /stream generate URLs without :8443; a created bin URL may therefore point at a different or unavailable service. The hostname should be used for allowlist validation while the validated host-and-port value is retained for the generated origin.
Useful? React with 👍 / 👎.
| const incoming = new URL(request.url); | ||
| const origin = wasmerOrigin(env); | ||
| const url = new URL(`${incoming.pathname}${incoming.search}`, origin); |
There was a problem hiding this comment.
When WASMER_ORIGIN is configured with a path, such as the explicitly accepted https://edge.example.test/base, constructing the target from an absolute /${incoming.pathname} discards /base and sends every request to the origin root instead. Deployments that expose MockHTTP below a path prefix therefore receive requests at the wrong application or return 404s. Join the incoming path beneath the configured base path, or reject path-bearing origin values instead of silently accepting and then ignoring them.
Useful? React with 👍 / 👎.
The How to Deploy guides from main still said the Worker forwards every request into the Fastify app and that Wasmer only rate-limits by the connecting address. Note the WASMER_TRAFFIC_PERCENT split, how a fork turns it off or points it at its own app, and how EDGE_PROXY_TOKEN keys proxied clients on Wasmer. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014wUSAto7jX3BKVDSm5YaJE
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #232 +/- ##
==========================================
Coverage 100.00% 100.00%
==========================================
Files 42 46 +4
Lines 1419 1554 +135
Branches 289 320 +31
==========================================
+ Hits 1419 1554 +135 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
3 participants
Please check if the PR fulfills these requirements
What kind of change does this PR introduce?
Feature. mockhttp.org stays on the Cloudflare Worker. Dynamic requests are still rate-limited there, and 10% of them are proxied to the Wasmer Node app.
What is the current behavior?
Every dynamic mockhttp.org request is handled by the Worker.
https://mockhttp.wasmer.appis a separate test app.What is the new behavior?
WASMER_TRAFFIC_PERCENTis10. The Worker hashes the client IP into a bucket from 0 to 99 and proxies buckets under 10 tohttps://mockhttp.wasmer.app. The same client stays on one backend. Documentation from Workers Assets is unchanged. RedirectLocationvalues that point at the Wasmer host are rewritten back to the incoming host. AllowlistedX-Forwarded-Hostvalues (mockhttp.org,www.mockhttp.org) are what echoed URLs use.Wasmer rate-limits by connecting IP, which would group every proxied client behind Cloudflare. Set the Wrangler secret
WASMER_EDGE_TOKENand the Wasmer secretEDGE_PROXY_TOKENto the same value before deploying this Worker so those clients are limited byx-mockhttp-client-ip.Other information
pnpm test: 47 files, 559 tests passed. Line coverage stayed at 100%.