Bound the proxy's read of a tenant 403 before retrying

The proxy checks a 403 from the tenant Worker for the binding handler's
token reject before retrying with the previous token. That check parsed
the whole cloned body, so a Worker could make the shared proxy buffer an
arbitrarily large response. Skip bodies that declare more than 256 bytes
and stop reading a stream once it passes that size; the response returned
to the caller still streams unbuffered.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: Brooooooklyn

platform/packages/proxy/src/dispatch.ts

@@ -65,20 +65,46 @@ function isGeneration(value: unknown): value is number {
   return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0;
 }
 
-/** The binding handler's reject for a token it does not hold, sent before any handler runs. */
+/** The binding handler's reject is `{"error":"unauthorized"}`; anything larger is not it. */
+const TOKEN_REJECTION_MAX_BYTES = 256;
+
+/**
+ * The binding handler's reject for a token it does not hold, sent before any handler runs.
+ * The tenant Worker controls this response, so only a small prefix is ever read and the
+ * returned response still streams unbuffered.
+ */
 async function isTokenRejection(res: Response): Promise<boolean> {
-  if (res.status !== 403) {
+  if (res.status !== 403 || !res.body) {
     return false;
   }
+  if (Number(res.headers.get('content-length')) > TOKEN_REJECTION_MAX_BYTES) {
+    return false;
+  }
+  const reader = res.clone().body!.getReader();
+  const chunks: Array<Uint8Array> = [];
+  let size = 0;
   try {
-    const data = await res.clone().json();
+    for (;;) {
+      const chunk = await reader.read();
+      if (chunk.done) {
+        break;
+      }
+      size += chunk.value.byteLength;
+      if (size > TOKEN_REJECTION_MAX_BYTES) {
+        return false;
+      }
+      chunks.push(chunk.value);
+    }
+    const data: unknown = JSON.parse(await new Blob(chunks).text());
     return (
       typeof data === 'object' &&
       data !== null &&
       (data as { error?: unknown }).error === 'unauthorized'
     );
   } catch {
     return false;
+  } finally {
+    void reader.cancel().catch(() => {});
   }
 }
 

platform/packages/proxy/test/unit/dispatch.test.ts

@@ -791,6 +791,65 @@ describe('proxy token generations', () => {
     expect(sent).toHaveLength(1);
   });
 
+  it('retries a reject that is streamed without a declared length', async () => {
+    const legacy = await tok(0);
+    const { env, sent } = setup({
+      resolution: { workerName: 'user-my-app', deploymentId: 'dpl_active', proxyTokenGen: 1 },
+      respond: (token) =>
+        token === legacy
+          ? Response.json('hello')
+          : new Response(new Blob(['{"error":"unauthorized"}']).stream(), { status: 403 }),
+    });
+
+    const res = await dispatchToWorker(env, PROJECT_ID, '/kv/get', KV_BODY);
+
+    expect(res?.status).toBe(200);
+    expect(sent.map((s) => s.token)).toEqual([await tok(1), legacy]);
+  });
+
+  it('does not read a 403 that declares a large body', async () => {
+    const { env, sent } = setup({
+      resolution: { workerName: 'user-my-app', deploymentId: 'dpl_active', proxyTokenGen: 1 },
+      respond: () =>
+        new Response('{"error":"unauthorized"}', {
+          status: 403,
+          headers: { 'content-length': String(64 * 1024 * 1024) },
+        }),
+    });
+
+    const res = await dispatchToWorker(env, PROJECT_ID, '/kv/get', KV_BODY);
+
+    expect(res?.status).toBe(403);
+    expect(sent).toHaveLength(1);
+  });
+
+  it('stops reading a streamed 403 once it outgrows a reject', async () => {
+    let pulls = 0;
+    const chunk = new TextEncoder().encode(' '.repeat(64));
+    const { env, sent } = setup({
+      resolution: { workerName: 'user-my-app', deploymentId: 'dpl_active', proxyTokenGen: 1 },
+      respond: () =>
+        new Response(
+          new ReadableStream<Uint8Array>({
+            pull(controller) {
+              pulls++;
+              controller.enqueue(chunk);
+            },
+          }),
+          { status: 403 },
+        ),
+    });
+
+    const res = await dispatchToWorker(env, PROJECT_ID, '/kv/get', KV_BODY);
+
+    expect(res?.status).toBe(403);
+    expect(sent).toHaveLength(1);
+    expect(pulls).toBeLessThan(16);
+    const reader = res!.body!.getReader();
+    expect((await reader.read()).value).toEqual(chunk);
+    await reader.cancel();
+  });
+
   it('returns the second reject when the Worker holds neither token', async () => {
     const { env, sent } = setup({
       resolution: { workerName: 'user-my-app', deploymentId: 'dpl_active', proxyTokenGen: 2 },