Keep request credentials out of frontend router data

Merged
MA
8d ago
+336-24

WebSocket request cookies, including HttpOnly credentials, were copied into frontend router state. Frontend on_load events could also return the raw server router metadata, exposing cookies even after the header serializer filtered them.

Keep request credentials on the server in both paths: omit Cookie, Authorization, Proxy-Authorization, Cloudflare Access assertions, OAuth2 Proxy access-token headers, AWS ALB OIDC tokens, and Google IAP assertions from serialized router headers, and stop copying state.router_data onto generated on-load events. Backend chains inherit the originating view through EventContext. This is a one-line source fix in reflex/state.py; StateUpdate serialization performs no added event filtering or cloning. Explicitly constructed application events retain any router_data supplied by the application.

Backend handlers and server-side state persistence retain the original headers. Frontend .headers.cookie and literal .headers["cookie"] access warn and render an empty string. Filtered raw_headers keys are absent; the docs explain indexed access and .get(..., "") fallbacks.

Validation on current main (749dd55b3):

  • Regressions failed before the fixes for indexed cookie access, HttpOnly cookies in frontend on-load event metadata, and authorization/proxy credentials in hydration. The AWS ALB/Google IAP regressions also failed in unit tests and real browser frames before adding the three header names. Header filtering covers nine names in three case variants.
  • The full unit suite passed 11,459 tests, with 159 skipped and 79.22% coverage, including state/event-processor routing and producer-level privacy regressions.
  • All 10 router browser cases passed in dev and production, including actual HttpOnly cookies, authorization/proxy credentials, AWS ALB tokens, and Google IAP assertions in WebSocket handshakes, backend access, and checking all received frames for secrets.
  • pyright reflex tests passed. Workspace pyright targeting Linux passed, and the remaining pre-commit hooks passed. The macOS workspace-wide pyright hook reports six pre-existing CPU-affinity typing errors in benchmark files.

The review's duplicate-header parsing report reproduces on main and is tracked separately in #7521, as the reviewer permits. This PR preserves the existing backend decoding behavior.

Covers ENG-12909. First layer of the token-protected endpoints project.

Next: #7361 → #7362 → #7363 → #7364. Enterprise companion: reflex-dev/reflex-enterprise#240.

Related to ENG-12909, ENG-9088.