VITEC/VITEC-website
2
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

SSR prep: asset proxy behind flag, forwarded proto, header hygiene

Browse Source 
Ticket 0054-FE section 5: (1) with the SSR flag on, /_frontend/assets/* is now proxied to the VPS release as well, deliberately without a file-exists guard so stale local SPA hashes cannot shadow the release; the proxy rules tag requests with env SSRPROXY and mod_headers adds X-Forwarded-Proto: https. (3) If-None-Match comparison in JsonCacheHeaders accepts the -gzip suffix that mod_deflate appends, so browser 304s work through compression. (4) X-TYPO3-Cache-Tags*/-Debug-Cache/-Cache-Lifetime/-Parsetime are stripped from responses (onsuccess and always tables - they leak record ids and overflowed the SSR node 16 KB header limit on news pages).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
orascheandClaude Fable 5 committed 2026-11-09 18:20:21 +01:00
1 parent 351349ec1f
commit 232aaf2ca8
2 files changed
+37 -3
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

public/.htaccess
+34 -2
View File
@@ -355,7 +355,13 @@ AddDefaultCharset utf-8
# synced by the SyncSsrFlag middleware / vitec:ssr-flag command).
# Emergency off without TYPO3: delete the flag file.
RewriteCond /usr/www/users/vitecevo/live/var/vitec-ssr-on.flag -f
RewriteRule ^$ https://vitec-ssr.evomedien.de/ [P,L]
RewriteRule ^$ https://vitec-ssr.evomedien.de/ [P,L,E=SSRPROXY:1]
# Flag ON: the hashed JS/CSS files come from the VPS release too
# (0054-FE 5.1 / 0055-BE question 1). No !-f guard on purpose: a
# same-named file from an older local SPA build must not win, the
# SSR HTML references the hashes of the VPS release.
RewriteCond /usr/www/users/vitecevo/live/var/vitec-ssr-on.flag -f
RewriteRule ^_frontend/assets/(.*)$ https://vitec-ssr.evomedien.de/_frontend/assets/$1 [P,L,E=SSRPROXY:1]
RewriteCond /usr/www/users/vitecevo/live/var/vitec-ssr-on.flag -f
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
@@ -366,7 +372,12 @@ AddDefaultCharset utf-8
RewriteCond %{REQUEST_URI} !^/api/
RewriteCond %{REQUEST_URI} !^/_frontend/
RewriteCond %{REQUEST_URI} !^/sitemap
RewriteRule ^(.*)$ https://vitec-ssr.evomedien.de/$1 [P,L]
RewriteRule ^(.*)$ https://vitec-ssr.evomedien.de/$1 [P,L,E=SSRPROXY:1]
# The SSR node derives absolute URLs from X-Forwarded-Host/-Proto;
# mod_proxy sends -Host on its own, -Proto needs a hand (0054-FE 5.2):
<IfModule mod_headers.c>
RequestHeader set X-Forwarded-Proto https env=SSRPROXY
</IfModule>
# ----------------------------------------------------------------------
# The root path needs its own rule: for "/" REQUEST_FILENAME is the
# docroot DIRECTORY, so the !-d guard below skips it and DirectoryIndex
@@ -439,6 +450,27 @@ Options -MultiViews
Header set X-Content-Type-Options "nosniff"
</IfModule>
# TYPO3 cache-tag/debug headers: internal ids, and on news pages >16 KB,
# which overflowed the SSR node's default header limit (0054-FE 5.4) -
# never send them to clients.
<IfModule mod_headers.c>
Header unset X-TYPO3-Cache-Tags
Header unset X-TYPO3-Cache-Tags-1
Header unset X-TYPO3-Cache-Tags-2
Header unset X-TYPO3-Cache-Tags-3
Header unset X-TYPO3-Debug-Cache
Header unset X-TYPO3-Cache-Lifetime
Header unset X-TYPO3-Parsetime
# Depending on the PHP SAPI these can sit in the "always" table:
Header always unset X-TYPO3-Cache-Tags
Header always unset X-TYPO3-Cache-Tags-1
Header always unset X-TYPO3-Cache-Tags-2
Header always unset X-TYPO3-Cache-Tags-3
Header always unset X-TYPO3-Debug-Cache
Header always unset X-TYPO3-Cache-Lifetime
Header always unset X-TYPO3-Parsetime
</IfModule>
# ETag removal - except for the /_json API: there TYPO3 (JsonCacheHeaders
# middleware) sends a content ETag so browsers can revalidate with 304
# (tickets 0011-FE / 0055-BE).