Dynamic host handling for email change confirmation links #2672
Conversation
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
WalkthroughThe PATCH handler for updating a user in the API has been modified to dynamically select the email confirmation URL domain based on the request's host header. The code now distinguishes between known application hostnames and partner domains, constructing the confirmation link accordingly instead of always using a hardcoded domain. Additionally, a new proxy module was added to re-export the email confirmation page component for a partner-specific path. Changes
Estimated code review effort1 (~5 minutes) Poem
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (1)
✅ Files skipped from review due to trivial changes (1)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
✨ Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
apps/web/app/api/user/route.ts (1)
162-162: Consider centralizing domain selection logic for reusability.The dynamic domain selection logic is likely to be needed in other parts of the application. Consider extracting this into a utility function to improve maintainability and consistency.
// utils/domain-selector.ts export function getConfirmationDomain(hostHeader: string | null): string { const hostName = hostHeader || ""; return APP_HOSTNAMES.has(hostName) ? APP_DOMAIN : PARTNERS_DOMAIN; }Then use it here:
-const hostName = req.headers.get("host") || ""; -const confirmUrl = APP_HOSTNAMES.has(hostName) - ? `${APP_DOMAIN}/auth/confirm-email-change/${token}` - : `${PARTNERS_DOMAIN}/auth/confirm-email-change/${token}`; +const domain = getConfirmationDomain(req.headers.get("host")); +const confirmUrl = `${domain}/auth/confirm-email-change/${token}`;
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
apps/web/app/api/user/route.ts(2 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: build
🔇 Additional comments (2)
apps/web/app/api/user/route.ts (2)
10-17: LGTM! Clean import additions for dynamic host handling.The added imports for
APP_HOSTNAMESandPARTNERS_DOMAINare necessary for the new dynamic host handling functionality.
150-153: Whitelist-based host selection prevents header injectionThe implementation relies on a predefined
APP_HOSTNAMESset to choose between two constant domains. The user-suppliedhostvalue only toggles betweenAPP_DOMAINandPARTNERS_DOMAIN—it never becomes part of the URL itself. There is no arbitrary‐host redirect risk here.•
APP_HOSTNAMES.has(hostName)guards against unrecognized hosts
•confirmUrlalways uses one of two fixed, environment‐derived domains
• No unvalidated user input is interpolated into the URLOptional enhancement (not required for security):
if (!APP_HOSTNAMES.has(hostName)) { console.warn(`Unexpected host header: ${hostName}`); }Likely an incorrect or invalid review comment.
Summary by CodeRabbit