Open
Conversation
Contributor
📝 WalkthroughWalkthroughModified tRPC client initialization for isomorphic SSR/client scenarios. Introduces header filtering to forward only Cookie headers from server-side, adds a new Changes
Sequence DiagramsequenceDiagram
participant Client as Client Browser
participant Server as Server (SSR)
participant TRPCFactory as createTRPCClientWithHeaders
participant Headers as getIsomorphicHeaders
participant Fetch as Fetch API
participant API as tRPC API Endpoint
Server->>Headers: getRequestHeaders()
Headers-->>Server: All request headers
Server->>TRPCFactory: createTRPCClientWithHeaders(apiUrl)
TRPCFactory->>Headers: Filter headers (Cookie only)
Headers-->>TRPCFactory: Filtered headers
TRPCFactory-->>Server: tRPC client instance
Client->>Server: Request page
Server->>TRPCFactory: Execute tRPC query
TRPCFactory->>Fetch: fetch with credentials + filtered headers
Fetch->>API: HTTP request (Cookie header included)
API-->>Fetch: Response
Fetch-->>TRPCFactory: Data
TRPCFactory-->>Server: Query result
Server-->>Client: HTML with data
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 1 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (1 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
apps/start/src/integrations/tanstack-query/root-provider.tsx (1)
46-66:⚠️ Potential issue | 🟡 MinorAvoid logging request options that may contain sensitive headers.
The error logging includes the full
optionsobject which contains headers (including the Cookie header). If these logs are persisted or accessible to unauthorized parties, this could expose session tokens.🛡️ Proposed fix to exclude sensitive data from logs
// Log HTTP errors on server if (!response.ok && typeof window === 'undefined') { const text = await response.clone().text(); console.error('[tRPC SSR Error]', { url: url.toString(), status: response.status, statusText: response.statusText, body: text, - options, + method: options?.method, }); } return response; } catch (error) { // Log fetch errors on server if (typeof window === 'undefined') { console.error('[tRPC SSR Error]', { url: url.toString(), error: error instanceof Error ? error.message : String(error), stack: error instanceof Error ? error.stack : undefined, - options, + method: options?.method, }); } throw error; }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@apps/start/src/integrations/tanstack-query/root-provider.tsx` around lines 46 - 66, The server-side error logs currently include the full options object (variable options) which may contain sensitive headers like Cookie; update both console.error calls in root-provider.tsx to sanitize options before logging by creating a shallow copy of options and removing or redacting sensitive headers (e.g., delete or replace options.headers.cookie and any Authorization header) or by logging a safe subset (method, url, status) instead of full options; ensure you reference the same variable names used in the diff (response, url, options) and apply the sanitization in both the non-OK response branch and the catch block.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In `@apps/start/src/integrations/tanstack-query/root-provider.tsx`:
- Around line 46-66: The server-side error logs currently include the full
options object (variable options) which may contain sensitive headers like
Cookie; update both console.error calls in root-provider.tsx to sanitize options
before logging by creating a shallow copy of options and removing or redacting
sensitive headers (e.g., delete or replace options.headers.cookie and any
Authorization header) or by logging a safe subset (method, url, status) instead
of full options; ensure you reference the same variable names used in the diff
(response, url, options) and apply the sanitization in both the non-OK response
branch and the catch block.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
Release Notes
Bug Fixes
New Features