Repository navigation
docs(edge): header rules now apply to hashed assets - #219
Merged
Merged
Conversation
The dispatch worker now applies routing.headerRules to hashed-asset GET responses (voidzero-dev/void-platform#182), so the Scope section's claim that rules "do not apply to hashed asset cache hits" is no longer true. - Document that rules reach hashed assets, and that this is what enables COOP/COEP/CORP on hashed worker/wasm assets for cross-origin isolation. - Explain the additive contract: tenants may add headers, but the platform-managed caching/representation/framing headers (Cache-Control, Content-Type, Content-Encoding, Content-Length, Content-Range, Accept-Ranges, Transfer-Encoding) are preserved so an immutable asset can't be mis-cached or corrupted. - Add a "Blocked headers" note for Set-Cookie and Clear-Site-Data (the cross-tenant cookie boundary on the shared *.void.app domain). - Note that hashed-asset rules are applied per-serve, so a rule change takes effect even when the content hash is unchanged. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
❌ Deploy Preview for staging-void-cloud failed.
|
cpojer
pushed a commit
that referenced
this pull request
Sep 11, 2026
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Companion to voidzero-dev/void-platform#182, which makes the dispatch worker apply
routing.headerRulesto hashed-assetGETresponses.The
edge/headers.mdScope section currently lists "Hashed asset cache hits" under rules that do not apply — that's no longer true once #182 ships. This corrects it:Cross-Origin-Embedder-Policy/Cross-Origin-Resource-Policyon hashed worker + wasm assets for cross-origin isolation (SharedArrayBuffer/ wasm threads).Cache-Control,Content-Type,Content-Encoding,Content-Length,Content-Range,Accept-Ranges,Transfer-Encoding) are preserved, so an immutable asset can't be mis-cached or corrupted.Set-CookieandClear-Site-Data(the cross-tenant cookie boundary on the shared*.void.appdomain — chore(deps): update dependency oxc-minify to ^0.129.0 #182 adds theClear-Site-Datablock).Note
Describes behavior introduced by voidzero-dev/void-platform#182 — ideally lands alongside that deploy.
🤖 Generated with Claude Code
Note
Low Risk
Documentation-only change with no runtime or config behavior in this repo.
Overview
Updates
docs/guide/edge/headers.mdso Scope matches dispatch behavior from voidzero-dev/void-platform#182: header rules do apply to hashed assetGETresponses (removed the old “hashed asset cache hits” exclusion).Documents why that matters for cross-origin isolation (COEP/CORP on hashed worker/wasm), the additive contract on immutable assets (platform-managed
Cache-Control,Content-Type, encoding/length/range/transfer headers cannot be overridden), and a new Blocked headers section forSet-CookieandClear-Site-Dataon shared*.void.app.Clarifies that hashed-asset rules run on every serve (including cache hits), so header changes take effect without a content-hash change.
Reviewed by Cursor Bugbot for commit 31d375c. Bugbot is set up for automated code reviews on this repo. Configure here.