SSR prep: asset proxy behind flag, forwarded proto, header hygiene

Ticket 0054-FE section 5: (1) with the SSR flag on, /_frontend/assets/* is now proxied to the VPS release as well, deliberately without a file-exists guard so stale local SPA hashes cannot shadow the release; the proxy rules tag requests with env SSRPROXY and mod_headers adds X-Forwarded-Proto: https. (3) If-None-Match comparison in JsonCacheHeaders accepts the -gzip suffix that mod_deflate appends, so browser 304s work through compression. (4) X-TYPO3-Cache-Tags*/-Debug-Cache/-Cache-Lifetime/-Parsetime are stripped from responses (onsuccess and always tables - they leak record ids and overflowed the SSR node 16 KB header limit on news pages).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

packages/vitec/Classes/Middleware/JsonCacheHeaders.php

@@ -42,7 +42,9 @@ final class JsonCacheHeaders implements MiddlewareInterface
 
         $etag = '"' . md5((string)$response->getBody()) . '"';
 
-        $ifNoneMatch = trim($request->getHeaderLine('If-None-Match'));
+        // mod_deflate suffixes the ETag it compressed ("<md5>-gzip");
+        // browsers send that form back, so accept it too (0054-FE 5.3).
+        $ifNoneMatch = str_replace('-gzip"', '"', trim($request->getHeaderLine('If-None-Match')));
         if ($ifNoneMatch !== '' && str_contains($ifNoneMatch, $etag)) {
             return (new Response())
                 ->withStatus(304)

public/.htaccess

@@ -355,7 +355,13 @@ AddDefaultCharset utf-8
 	# synced by the SyncSsrFlag middleware / vitec:ssr-flag command).
 	# Emergency off without TYPO3: delete the flag file.
 	RewriteCond /usr/www/users/vitecevo/live/var/vitec-ssr-on.flag -f
-	RewriteRule ^$ https://vitec-ssr.evomedien.de/ [P,L]
+	RewriteRule ^$ https://vitec-ssr.evomedien.de/ [P,L,E=SSRPROXY:1]
+	# Flag ON: the hashed JS/CSS files come from the VPS release too
+	# (0054-FE 5.1 / 0055-BE question 1). No !-f guard on purpose: a
+	# same-named file from an older local SPA build must not win, the
+	# SSR HTML references the hashes of the VPS release.
+	RewriteCond /usr/www/users/vitecevo/live/var/vitec-ssr-on.flag -f
+	RewriteRule ^_frontend/assets/(.*)$ https://vitec-ssr.evomedien.de/_frontend/assets/$1 [P,L,E=SSRPROXY:1]
 	RewriteCond /usr/www/users/vitecevo/live/var/vitec-ssr-on.flag -f
 	RewriteCond %{REQUEST_FILENAME} !-f
 	RewriteCond %{REQUEST_FILENAME} !-d
@@ -366,7 +372,12 @@ AddDefaultCharset utf-8
 	RewriteCond %{REQUEST_URI} !^/api/
 	RewriteCond %{REQUEST_URI} !^/_frontend/
 	RewriteCond %{REQUEST_URI} !^/sitemap
-	RewriteRule ^(.*)$ https://vitec-ssr.evomedien.de/$1 [P,L]
+	RewriteRule ^(.*)$ https://vitec-ssr.evomedien.de/$1 [P,L,E=SSRPROXY:1]
+	# The SSR node derives absolute URLs from X-Forwarded-Host/-Proto;
+	# mod_proxy sends -Host on its own, -Proto needs a hand (0054-FE 5.2):
+	<IfModule mod_headers.c>
+		RequestHeader set X-Forwarded-Proto https env=SSRPROXY
+	</IfModule>
 	# ----------------------------------------------------------------------
 	# The root path needs its own rule: for "/" REQUEST_FILENAME is the
 	# docroot DIRECTORY, so the !-d guard below skips it and DirectoryIndex
@@ -439,6 +450,27 @@ Options -MultiViews
 	Header set X-Content-Type-Options "nosniff"
 </IfModule>
 
+# TYPO3 cache-tag/debug headers: internal ids, and on news pages >16 KB,
+# which overflowed the SSR node's default header limit (0054-FE 5.4) -
+# never send them to clients.
+<IfModule mod_headers.c>
+	Header unset X-TYPO3-Cache-Tags
+	Header unset X-TYPO3-Cache-Tags-1
+	Header unset X-TYPO3-Cache-Tags-2
+	Header unset X-TYPO3-Cache-Tags-3
+	Header unset X-TYPO3-Debug-Cache
+	Header unset X-TYPO3-Cache-Lifetime
+	Header unset X-TYPO3-Parsetime
+	# Depending on the PHP SAPI these can sit in the "always" table:
+	Header always unset X-TYPO3-Cache-Tags
+	Header always unset X-TYPO3-Cache-Tags-1
+	Header always unset X-TYPO3-Cache-Tags-2
+	Header always unset X-TYPO3-Cache-Tags-3
+	Header always unset X-TYPO3-Debug-Cache
+	Header always unset X-TYPO3-Cache-Lifetime
+	Header always unset X-TYPO3-Parsetime
+</IfModule>
+
 # ETag removal - except for the /_json API: there TYPO3 (JsonCacheHeaders
 # middleware) sends a content ETag so browsers can revalidate with 304
 # (tickets 0011-FE / 0055-BE).