feat: add support for skew protection #746

vicb · 2025-06-20T12:59:38Z

There are 2 main files in this PR:

packages/cloudflare/src/cli/commands/skew-protection.ts (build time)

This builds a mapping from deploymentId to the worker version at build time.
Note that because the worker you are building has no version yet, "current" is used instead.

packages/cloudflare/src/cli/templates/skew-protection.ts (runtime)

At runtime, if a particular version is requested and it is present in the mapping,
we'll fetch the result from a preview URL with a hostname of <version>-<worker_name>.<domain>.workers.dev

How to use it:

set cloudflare.skewProtection.enabled to true in your OpenNext config
provide values for the new env vars added to packages/cloudflare/src/api/cloudflare-context.ts
update your next config to set the deployementId - you can use the getDeploymentId() helper
set run_worker_first to true

Docs PR opennextjs/docs#164

TODO:

add tests
handle assets (will need to run the worker before the asset worker)
follow-up: move the skew protection logic in the aws/routing layer with pluggable overrides -> see feat: add support for serving assets from the routing layer #768

changeset-bot · 2025-06-20T12:59:41Z

🦋 Changeset detected

Latest commit: 17064f4

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@opennextjs/cloudflare	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

pkg-pr-new · 2025-06-20T13:00:32Z

Open in StackBlitz

npm i https://pkg.pr.new/@opennextjs/cloudflare@746

commit: 17064f4

conico974

I just took a really quick look for now, will make a proper review later

packages/cloudflare/src/cli/templates/skew-protection.ts

james-elicx

I think this is looking pretty good on my initial read though. Going to have another look later on as well.

packages/cloudflare/src/cli/commands/skew-protection.ts

james-elicx

I think this looks good and the logic makes sense to me.

It might be nice for us to look at having an e2e that runs against a deployment at some point in the future, for testing features like this.

packages/cloudflare/src/cli/build/open-next/compile-skew-protection.ts

sommeeeer

LGTM

packages/cloudflare/src/cli/commands/skew-protection.ts

packages/cloudflare/src/cli/templates/skew-protection.ts

vicb · 2025-06-24T16:33:29Z

Thanks for the review @sommeeeer !

conico974

Just a few nits/question, other than that LGTM

packages/cloudflare/src/cli/build/open-next/compile-skew-protection.spec.ts

packages/cloudflare/src/cli/build/open-next/compile-skew-protection.ts

conico974 · 2025-06-24T20:20:01Z

packages/cloudflare/src/cli/commands/helpers.ts

+ * @param options Options to pass to `getPlatformProxy`, i.e. to set the environment
+ * @returns the env vars
+ */
+export async function getEnvFromPlatformProxy(options: GetPlatformProxyOptions) {


I think we should have only one instance of this, that we spawn at the beginning and that we dispose at the end. It's a bit wasteful to launch multiple workerd process.
And once we have support for remote bindings here, we could reuse it to populate the cache directly (which should be way faster)

packages/cloudflare/src/cli/commands/skew-protection.ts

conico974 · 2025-06-24T20:32:58Z

packages/cloudflare/src/cli/templates/skew-protection.ts

+		path = path.slice(basePath.length);
+	}
+	if (path.startsWith("/_next/static/") || isFileInTree(path, __CF_ASSETS_TREE__)) {
+		return assets.fetch(request);


Does this one respect the _headers file ?

It should but I'll test that

Actually it doesn't, see https://developers.cloudflare.com/workers/static-assets/headers/#custom-headers

Follow up:

Check what Next does add by default and apply that in the asset resolver

Document how to override (using middleware or Next config)

Co-authored-by: conico974 <[email protected]>

vicb · 2025-07-09T09:42:05Z

I have rebase the PR on top of #768 as the asset resolver will be used to resolve the assets from previous versions (when run_worker_first=false the worker does not get a chance to override the assets as they are served even before the worker is executed).

Docs plan (today/tomorrow)

write some new doc for the asset resolver
update the existing doc for the skew protection to sync with this PR

@dario-piotrowicz @james-elicx @conico974 please take a look at the PR when you get a chance.

Thanks!

conico974

Just a few nits/question, but other than that LGTM.
BTW do we want to allow users to override the assets resolver ?

conico974 · 2025-07-09T11:55:42Z

examples/playground15/app/api/env/route.ts

@@ -4,5 +4,7 @@
 export const dynamic = "force-dynamic";

 export async function GET() {
-	return new Response(JSON.stringify(process.env));
+	return new Response(JSON.stringify(process.env, null, 2), {


Why this change ?

I used this API for debugging (the env contains the build id, deployment id, and deployment mapping) and the response was easier to read when formatted this way.

packages/cloudflare/src/api/cloudflare-context.ts

conico974 · 2025-07-09T12:01:17Z

packages/cloudflare/src/cli/commands/skew-protection.spec.ts

+
+			const now = Date.now();
+
+			client.workers.scripts.versions.list = vi.fn().mockReturnValue([


Can the client return this in the wrong order ? This is not tested here

In my experience, the client always returns an ordered lists.

BUT I agree we should not rely on the result of a few experiments.

That's why I pay special attention to not order the input (~2 is before ~1) and you can see that the output of listWorkerVersions is ordered (~2 after ~1)

packages/cloudflare/src/cli/templates/skew-protection.ts

Co-authored-by: conico974 <[email protected]>

vicb · 2025-07-09T15:20:28Z

BTW do we want to allow users to override the assets resolver ?

Yes we should but I agree that our current defineCloudflareConfig is not flexible enough:

export default {
	...defineCloudflareConfig({
		incrementalCache: r2IncrementalCache,
	}),
	cloudflare: {
		skewProtection: {
			enabled: false,
		},
	},
} satisfies OpenNextConfig;

As of today users can override the assets resolver but the syntax is not great.

I'll try to work on a better way to do that.

vicb force-pushed the vicb/skew-protection branch from 2356748 to 0a6f2dd Compare June 20, 2025 13:11

vicb requested review from conico974, james-elicx, dario-piotrowicz and sommeeeer and removed request for conico974 June 20, 2025 13:11

vicb force-pushed the vicb/skew-protection branch from 0a6f2dd to 18ba05a Compare June 20, 2025 13:14

vicb requested a review from IgorMinar June 20, 2025 13:26

conico974 reviewed Jun 20, 2025

View reviewed changes

packages/cloudflare/src/cli/templates/skew-protection.ts Outdated Show resolved Hide resolved

james-elicx reviewed Jun 20, 2025

View reviewed changes

packages/cloudflare/src/cli/commands/skew-protection.ts Outdated Show resolved Hide resolved

james-elicx approved these changes Jun 22, 2025

View reviewed changes

vicb force-pushed the vicb/skew-protection branch 4 times, most recently from 4c21542 to 471111c Compare June 23, 2025 12:13

vicb mentioned this pull request Jun 24, 2025

[Blocked by release] docs(cloudflare): skew protection opennextjs/docs#164

Merged

vicb changed the title ~~[Preview] Add support for skew protection~~ Add support for skew protection Jun 24, 2025

sommeeeer reviewed Jun 24, 2025

View reviewed changes

packages/cloudflare/src/cli/build/open-next/compile-skew-protection.ts Outdated Show resolved Hide resolved

sommeeeer reviewed Jun 24, 2025

View reviewed changes

packages/cloudflare/src/cli/build/open-next/compile-skew-protection.ts Outdated Show resolved Hide resolved

sommeeeer approved these changes Jun 24, 2025

View reviewed changes

packages/cloudflare/src/cli/commands/skew-protection.ts Show resolved Hide resolved

packages/cloudflare/src/cli/templates/skew-protection.ts Outdated Show resolved Hide resolved

sommeeeer approved these changes Jun 24, 2025

View reviewed changes

conico974 approved these changes Jun 24, 2025

View reviewed changes

vicb force-pushed the vicb/skew-protection branch from 2f1f47b to 45edc9f Compare June 30, 2025 12:50

vicb changed the title ~~Add support for skew protection~~ [WIP] Add support for skew protection Jul 4, 2025

vicb force-pushed the vicb/skew-protection branch from 43be1dd to 12c4094 Compare July 8, 2025 10:03

vicb mentioned this pull request Jul 9, 2025

feat: add config flag support for deploy, preview, and upload commands #762

Draft

vicb force-pushed the vicb/skew-protection branch from 12c4094 to 637d8f4 Compare July 9, 2025 09:32

vicb changed the title ~~[WIP] Add support for skew protection~~ feat: add support for skew protection Jul 9, 2025

Add support for skew protection

ca41ac2

Co-authored-by: conico974 <[email protected]>

vicb force-pushed the vicb/skew-protection branch from 637d8f4 to ca41ac2 Compare July 9, 2025 09:39

vicb requested review from conico974 and james-elicx July 9, 2025 09:42

conico974 approved these changes Jul 9, 2025

View reviewed changes

Update packages/cloudflare/src/cli/templates/skew-protection.ts

22cdb36

Co-authored-by: conico974 <[email protected]>

james-elicx approved these changes Jul 9, 2025

View reviewed changes

vicb added 2 commits July 9, 2025 17:07

fixup! serve the current version on unkown dep

6b75bcf

fixup! expand doc for CF_WORKER_NAME

17064f4

vicb merged commit 6d020fe into main Jul 10, 2025
7 of 8 checks passed

vicb deleted the vicb/skew-protection branch July 10, 2025 08:13

workers-frameworks mentioned this pull request Jul 8, 2025

Version Packages #771

Merged


		const now = Date.now();

		client.workers.scripts.versions.list = vi.fn().mockReturnValue([

feat: add support for skew protection #746

feat: add support for skew protection #746

Uh oh!

Conversation

vicb commented Jun 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot bot commented Jun 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

pkg-pr-new bot commented Jun 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

conico974 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

james-elicx left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

james-elicx left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

sommeeeer left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

vicb commented Jun 24, 2025

Uh oh!

conico974 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

vicb commented Jul 9, 2025

Uh oh!

conico974 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

vicb commented Jul 9, 2025

Uh oh!

Uh oh!

Uh oh!

vicb commented Jun 20, 2025 •

edited

Loading

changeset-bot bot commented Jun 20, 2025 •

edited

Loading

pkg-pr-new bot commented Jun 20, 2025 •

edited

Loading