rsc POST request / broken links / proxy

[aheissenberger]

Describe the bug

If react-server is used behind a proxy, the output of rsc content request per POST will contain links which include the host name of the intermediate server (e.g. AWS API Gateway) and not the orgin name. These link do not work as the gateway is configured to only accept requests from CloudFront (reverse proxy).

GET https://d8fwy4rvoxvem.cloudfront.net/about/rsc.x-component (browser do not add origin headers with get requests!)

:HL["/assets/layout-BiA6qYYC.css","style"]
:Hm"/client/__/__/packages/react-server/client/navigation.Bvk-OYYg.mjs"
:Hm"/client/__/__/packages/react-server/client/ErrorBoundary.DT2bF0V6.mjs"

POST https://d8fwy4rvoxvem.cloudfront.net/about/rsc.x-component (browser have to add a origin header)

:HL["https://lj6xvxw6cf.execute-api.eu-west-1.amazonaws.com/assets/layout-BiA6qYYC.css","style"]
0:[["$","link",null,{"rel":"preconnect","href":"https://d8fwy4rvoxvem.cloudfront.net","id":"live-io"}],false,[["$","link","https://d8fwy4rvoxvem.cloudfront.net/assets/layout-BiA6qYYC.css",{"rel":"stylesheet","href":"https://d8fwy4rvoxvem.cloudfront.net/assets/layout-BiA6qYYC.css","precedence":"default"}]],null,"$L1"]
:HL["/assets/layout-BiA6qYYC.css","style"]

process.env.ORIGIN=https://d8fwy4rvoxvem.cloudfront.net

1. Problem: comparing host with origin - host ist only the hostname, where origin is <protocol>://<hostname>. The code part host !== origin will always true e.g. "localhost"!=="http://localhost":

react-server/packages/react-server/server/render-rsc.jsx

Lines 334 to 337 in c52af29

	const linkHref =
	remote || (origin && host !== origin)
	? (link) => `${protocol}//${host}${configBaseHref(link)}`
	: configBaseHref;

react-server/packages/react-server/server/render-rsc.jsx

Lines 363 to 366 in c52af29

	const ModulePreloads =
	configModulePreload !== false &&
	!(remote || (origin && host !== origin))
	? () => {

2. Problem: host is used for the links and not the value for origin from config.origin
   I do not understand all reason behind using host and ignoring the optional existing origin in config.origin.
   But behind a proxy this broke the app until I fixed it by forcing the header to process.env.ORING in the wrapper around middleware().

The question here is where proxy detection and support should be handled. At least all parts of react-server should respect an existing definition of the ORIGIN as part of the configuration of createReactServer.
I also understand that you would like to support a scenario where the remote components are on servers which are not exposed to the internet.

3. Problem: <Link> component mouse hover
   The hover will trigger a GET request for the rsc content of the page but when navigation to the page the same content is a gain requested by a POST request.

Reproduction

No response

Steps to reproduce

1. clone react-server repository and install dependencies
2. cd examples/photos
3. pnpm build && ORIGIN=REALORIGIN pnpm start

GET request for rsc data (no origin set by browser):

  curl 'http://localhost:3000/photos/0/@modal.rsc.x-component' \
  -H 'Accept-Language: de-AT,de-DE;q=0.9,de;q=0.8,en-US;q=0.7,en;q=0.6' \
  -H 'Cache-Control: no-cache' \
  -H 'Connection: keep-alive' \
  -H 'Content-Type: text/plain;charset=UTF-8' \
  -b 'sidebar_state=true' \
  -H 'Pragma: no-cache' \
  -H 'Referer: http://PROXYORIGIN:3000/photos/0' \
  -H 'User-Agent: Mozilla/5.0' \
  -H 'accept: text/x-component'

POST request with origin:

curl 'http://localhost:3000/photos/0/@modal.rsc.x-component' \
  -H 'Accept-Language: de-AT,de-DE;q=0.9,de;q=0.8,en-US;q=0.7,en;q=0.6' \
  -H 'Cache-Control: no-cache' \
  -H 'Connection: keep-alive' \
  -H 'Content-Type: text/plain;charset=UTF-8' \
  -b 'sidebar_state=true' \
  -H 'Origin: http://PROXYORIGIN:3000' \
  -H 'Pragma: no-cache' \
  -H 'Referer: http://PROXYORIGIN:3000/photos/0' \
  -H 'User-Agent: Mozilla/5.0' \
  -H 'accept: text/x-component' \
  --data-raw '{}'

System Info

System:
    OS: macOS 15.7.1
    CPU: (12) arm64 Apple M4 Pro
    Memory: 2.11 GB / 48.00 GB
    Shell: 5.9 - /bin/zsh
  Binaries:
    Node: 25.1.0 - /opt/homebrew/bin/node
    npm: 11.6.2 - /opt/homebrew/bin/npm
    pnpm: 9.15.5 - /opt/homebrew/bin/pnpm
  Browsers:
    Chrome: 141.0.7390.123
  npmPackages:
    @lazarv/react-server: workspace:^ => 0.0.0

Used Package Manager

pnpm

Logs

No response

Validations

• Follow our Code of Conduct
• Read the Contributing Guidelines.
• Read the docs.
• Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
• Check that this is a concrete bug. For Q&A open a GitHub Discussion.
• The provided reproduction is a minimal reproducible example of the bug.