🐛 BUG: Miniflare overwrites the hostname of request when a custom route is defined

[andrewmd5]

Which Cloudflare product(s) does this pertain to?

Miniflare

What versions are you using?

3.111.0

What operating system and version are you using?

macOS

Please provide a link to a minimal reproduction

No response

Describe the Bug

When a wrangler.toml has a custom route defined, Miniflare seems to sets the hostname of the request to that route, which breaks OAuth implementations that expect it to be the same redirect_uri that was whitelisted.

Please provide any relevant error logs

No response

[jamesopstad]

Thanks. Are you able to provide a reproduction of how this is breaking OAuth?

[andrewmd5]

Thanks. Are you able to provide a reproduction of how this is breaking OAuth?

Look at OpenAuth as an example.

export function getRelativeUrl(ctx: Context, path: string) {
  const result = new URL(path, ctx.req.url)
  result.host = ctx.req.header("x-forwarded-host") || result.host
  return result.toString()
}

const authorization = new URL(config.endpoint.authorization)
        authorization.searchParams.set("client_id", config.clientID)
        authorization.searchParams.set(
          "redirect_uri",
          getRelativeUrl(c, "./callback"),
        )

This code is going to ultimately fail for local development because ' ctx.req.url' becomes the value of the custom route, which means means the 'redirect_uri' can either end up as a URI that is not whitelisted on the OAuth provider or goes to a live production serve if the route is deployed.

[petebacondarwin]

Thanks for the extra info @andrewmd5 - I am not quite sure I follow the exact problem here.

Are you using Miniflare directly or via Wrangler?

• If using Miniflare have you tried setting the upstream option? https://developers.cloudflare.com/workers/testing/miniflare/core/fetch/#upstream
• If using Wrangler have you tried setting the host options? https://developers.cloudflare.com/workers/wrangler/configuration/#local-development-settings

For us to look into this further please can you provide a minimal reproduction via a git repo that we can clone and try out.