fix(security): validate supplemental interception selectors (#2976)

* fix(security): verify interception cache identities

* fix(security): bypass caches for interception selectors

* fix(security): preserve caching for verified interception selectors

* fix(cache): delegate selector policy to CDN adapter

Author: james-elicx

packages/vinext/src/entries/app-rsc-entry.ts

@@ -642,6 +642,10 @@ function findIntercept(pathname, sourcePathname = null, interceptionId = null) {
   return __routeMatcher.findIntercept(pathname, sourcePathname, interceptionId);
 }
 
+function hasInterceptionId(interceptionId) {
+  return __routeMatcher.hasInterceptionId(interceptionId);
+}
+
 async function buildPageElements(route, params, routePath, pageRequest, layoutParamAccess, displayPathname = routePath, scriptNonce) {
   // Hydrate lazy page/route-handler modules before any synchronous read.
   await __ensureRouteLoaded(route);
@@ -1271,6 +1275,7 @@ export default createAppRscHandler({
   }
   matchRoute,
   matchRequestRoute,
+  hasInterceptionId,
   matchInterceptRoute(pathname, sourcePathname, interceptionId) {
     const intercept = findIntercept(pathname, sourcePathname, interceptionId);
     if (!intercept) return null;

packages/vinext/src/server/app-page-cache-finalizer.ts

@@ -19,6 +19,7 @@ type AppPageRscCacheKeyBuilder = (
   mountedSlotsHeader?: string | null,
   renderMode?: AppRscRenderMode,
   interceptionContext?: string | null,
+  interceptionId?: string | null,
 ) => string;
 type AppPageRequestCacheLife = {
   revalidate?: number;
@@ -45,6 +46,7 @@ type FinalizeAppPageHtmlCacheResponseOptions = {
   isrRscKey: AppPageRscCacheKeyBuilder;
   isrSet: AppPageCacheSetter;
   interceptionContext?: string | null;
+  interceptionId?: string | null;
   omitPendingDynamicCacheState?: boolean;
   preserveClientResponseHeaders?: boolean;
   expireSeconds?: number;
@@ -66,6 +68,7 @@ type ScheduleAppPageRscCacheWriteOptions = {
   isrRscKey: AppPageRscCacheKeyBuilder;
   isrSet: AppPageCacheSetter;
   interceptionContext?: string | null;
+  interceptionId?: string | null;
   mountedSlotsHeader?: string | null;
   omitPendingDynamicCacheState?: boolean;
   renderMode?: AppRscRenderMode;
@@ -85,17 +88,15 @@ function applyPendingDynamicCdnHeaders(
   finalizePendingCacheStateHeaders(headers, options);
 }
 
-function applyMountedSlotRscNoStoreHeaders(
+function applyUncacheableRscVariantNoStoreHeaders(
   headers: Headers,
   options: { omitCacheState?: boolean } = {},
 ): void {
   // Mounted-slot RSC payloads deliberately bypass the slot-blind persistent
-  // cache. Make that same bypass explicit to every CDN adapter: an edge-managed
-  // adapter may intentionally cache pending-dynamic responses, so the generic
-  // pendingDynamicCheck signal is not strong enough for this variant.
-  // This branch additionally forces no-store because mounted variants have no
-  // persistent admission path at all. The active adapter clears any stale
-  // provider-specific headers that it owns.
+  // cache. Make that same bypass explicit to
+  // every CDN adapter: an edge-managed adapter may intentionally cache
+  // pending-dynamic responses, so that generic signal is not strong enough.
+  // The active adapter clears any stale provider-specific headers that it owns.
   applyCdnResponseHeaders(headers, { cacheControl: NO_STORE_CACHE_CONTROL });
   // Dynamic and draft responses intentionally have no cache state. Do not
   // manufacture a MISS solely because the request carried mounted slots.
@@ -169,6 +170,7 @@ export function finalizeAppPageHtmlCacheResponse(
     null,
     undefined,
     options.interceptionContext,
+    options.interceptionId,
   );
   const clientHeaders = new Headers(response.headers);
   if (options.preserveClientResponseHeaders !== true) {
@@ -266,14 +268,14 @@ export function finalizeAppPageRscCacheResponse(
   // slots because edge-managed adapters may cache pending-dynamic responses.
   scheduleAppPageRscCacheWrite(options);
 
-  const isMountedSlotVariant = Boolean(options.mountedSlotsHeader);
-  if (options.preserveClientResponseHeaders === true && !isMountedSlotVariant) {
+  const isUncacheableVariant = Boolean(options.mountedSlotsHeader);
+  if (options.preserveClientResponseHeaders === true && !isUncacheableVariant) {
     return response;
   }
 
   const clientHeaders = new Headers(response.headers);
-  if (isMountedSlotVariant) {
-    applyMountedSlotRscNoStoreHeaders(clientHeaders, {
+  if (isUncacheableVariant) {
+    applyUncacheableRscVariantNoStoreHeaders(clientHeaders, {
       omitCacheState: options.omitPendingDynamicCacheState === true,
     });
   } else {
@@ -302,6 +304,7 @@ export function scheduleAppPageRscCacheWrite(
     null,
     options.renderMode,
     options.interceptionContext,
+    options.interceptionId,
   );
   const cachePromise = (async () => {
     try {

packages/vinext/src/server/app-page-cache.ts

@@ -38,6 +38,7 @@ type AppPageRscCacheKeyBuilder = (
   mountedSlotsHeader?: string | null,
   renderMode?: AppRscRenderMode,
   interceptionContext?: string | null,
+  interceptionId?: string | null,
 ) => string;
 export type AppPageCacheOutcomeMetric = Readonly<{
   artifact: "html" | "rsc";
@@ -92,6 +93,7 @@ type ReadAppPageCacheResponseOptions = {
   isrRscKey: AppPageRscCacheKeyBuilder;
   isrSet: AppPageCacheSetter;
   interceptionContext?: string | null;
+  interceptionId?: string | null;
   hasRequestSearchParams?: boolean;
   middlewareHeaders?: Headers | null;
   middlewareStatus?: number | null;
@@ -370,6 +372,7 @@ export async function readAppPageCacheResponse(
         null,
         options.renderMode,
         options.interceptionContext,
+        options.interceptionId,
       )
     : options.isrHtmlKey(options.cleanPathname);
   const artifact = options.isRscRequest ? "rsc" : "html";
@@ -479,6 +482,7 @@ export async function readAppPageCacheResponse(
                   null,
                   options.renderMode,
                   options.interceptionContext,
+                  options.interceptionId,
                 ),
             buildAppPageCacheValue(
               "",

packages/vinext/src/server/app-page-dispatch.ts

@@ -82,7 +82,7 @@ import {
 import { shouldServeStreamingMetadata } from "./streaming-metadata.js";
 import { createAppPageTreePath } from "./app-page-route-wiring.js";
 import type { AppPageSsrHandler } from "./app-page-stream.js";
-import { VINEXT_PRERENDER_SPECULATIVE_HEADER } from "./headers.js";
+import { VINEXT_INTERCEPTION_ID_HEADER, VINEXT_PRERENDER_SPECULATIVE_HEADER } from "./headers.js";
 import type { ClientReuseManifestParseResult } from "./client-reuse-manifest.js";
 import { buildAppPageTags } from "./implicit-tags.js";
 import type { AppPageCacheSetter, ISRCacheEntry } from "./isr-cache.js";
@@ -342,6 +342,7 @@ export type DispatchAppPageOptions<TRoute extends AppPageDispatchRoute> = {
     mountedSlotsHeader?: string | null,
     renderMode?: AppRscRenderMode,
     interceptionContext?: string | null,
+    interceptionId?: string | null,
   ) => string;
   isrSet: AppPageCacheSetter;
   loadSsrHandler: () => Promise<AppPageSsrHandler>;
@@ -627,6 +628,9 @@ async function dispatchAppPageInner<TRoute extends AppPageDispatchRoute>(
   const route = options.route;
   const dynamicConfig = options.dynamicConfig;
   const currentRevalidateSeconds = options.revalidateSeconds;
+  const interceptionId = options.isRscRequest
+    ? options.request.headers.get(VINEXT_INTERCEPTION_ID_HEADER)
+    : null;
   const isForceStatic = dynamicConfig === "force-static";
   const isDynamicError = dynamicConfig === "error";
   const isForceDynamic = dynamicConfig === "force-dynamic";
@@ -723,6 +727,7 @@ async function dispatchAppPageInner<TRoute extends AppPageDispatchRoute>(
       isrRscKey: options.isrRscKey,
       isrSet: options.isrSet,
       interceptionContext: options.interceptionContext,
+      interceptionId,
       middlewareHeaders: options.middlewareContext.headers,
       middlewareStatus: options.middlewareContext.status,
       mountedSlotsHeader: options.mountedSlotsHeader,
@@ -1137,6 +1142,7 @@ async function dispatchAppPageInner<TRoute extends AppPageDispatchRoute>(
     isrRscKey: options.isrRscKey,
     isrSet: options.isrSet,
     interceptionContext: options.interceptionContext,
+    interceptionId,
     expireSeconds: options.expireSeconds,
     // A loading convention at tree position N wraps descendants, but not a
     // layout co-located at N. Probing any deeper async layout before creating

packages/vinext/src/server/app-page-render.ts

@@ -151,9 +151,11 @@ type RenderAppPageLifecycleOptions = {
     mountedSlotsHeader?: string | null,
     renderMode?: AppRscRenderMode,
     interceptionContext?: string | null,
+    interceptionId?: string | null,
   ) => string;
   isrSet: AppPageCacheSetter;
   interceptionContext?: string | null;
+  interceptionId?: string | null;
   layoutCount: number;
   loadSsrHandler: () => Promise<AppPageSsrHandler>;
   middlewareContext: AppPageMiddlewareContext;
@@ -820,7 +822,8 @@ export async function renderAppPageLifecycle(
     // When skip transport is enabled, omit cacheState because the response is a
     // per-client payload, not a shared-cache MISS/HIT artifact. The absence also
     // keeps finalizeAppPageRscCacheResponse from overwriting no-store.
-    const rscResponsePolicy = shouldBypassRscCacheForSkipTransport
+    const shouldBypassRscCache = shouldBypassRscCacheForSkipTransport;
+    const rscResponsePolicy = shouldBypassRscCache
       ? { cacheControl: NO_STORE_CACHE_CONTROL }
       : resolveAppPageRscResponsePolicy({
           dynamicUsedDuringBuild,
@@ -832,7 +835,7 @@ export async function renderAppPageLifecycle(
           expireSeconds,
           revalidateSeconds,
         });
-    if (shouldBypassRscCacheForSkipTransport) {
+    if (shouldBypassRscCache) {
       options.isrDebug?.("RSC cache write skipped (skip transport payload)", options.cleanPathname);
     }
     const shouldEmitDynamicStaleTime =
@@ -955,6 +958,7 @@ export async function renderAppPageLifecycle(
       isrRscKey: options.isrRscKey,
       isrSet: options.isrSet,
       interceptionContext: options.interceptionContext,
+      interceptionId: options.interceptionId,
       mountedSlotsHeader: options.mountedSlotsHeader,
       omitPendingDynamicCacheState: options.omitPendingDynamicCacheState,
       renderMode: options.renderMode,
@@ -1268,6 +1272,7 @@ export async function renderAppPageLifecycle(
       isrRscKey: options.isrRscKey,
       isrSet: options.isrSet,
       interceptionContext: options.interceptionContext,
+      interceptionId: options.interceptionId,
       omitPendingDynamicCacheState: options.omitPendingDynamicCacheState,
       preserveClientResponseHeaders: !htmlResponsePolicy.shouldWriteToCache,
       expireSeconds,

packages/vinext/src/server/app-rsc-cache-busting.ts

@@ -417,39 +417,51 @@ export async function resolveInvalidRscCacheBustingRequest(
   if (actualHash !== null && actualHash !== expectedHash) {
     acceptedHashes.add(computeLegacyRscCacheBustingSearchParam(options.request.headers));
     const compatibilityInputs: CreateCacheBustingInputOptions[] = [];
+    const hasInterceptionId = options.request.headers.has(VINEXT_INTERCEPTION_ID_HEADER);
     const hasStateFingerprint = options.request.headers.has(VINEXT_RSC_STATE_FINGERPRINT_HEADER);
     const hasNormalRenderMode =
       normalizeRenderModeHeaderValue(options.request.headers.get(VINEXT_RSC_RENDER_MODE_HEADER)) ===
       null;
     // The interception ID is a positional hash input, so omitting it changes
-    // hashes even when the request does not carry the header. Accept every
-    // combination of the rollout-era inputs to keep in-flight RSC requests
-    // valid while old and new clients overlap.
-    compatibilityInputs.push({ includeInterceptionIdHeader: false });
+    // hashes even when the request does not carry the header. Requests from
+    // clients predating that positional input remain compatible when the
+    // header is absent. Once the header is present, however, only hashes that
+    // include its value are safe: Cloudflare's default cache key is URL-based
+    // and does not vary on arbitrary headers, while different graph-owned IDs
+    // can intentionally select different slot bytes for one source/target.
+    if (!hasInterceptionId) {
+      compatibilityInputs.push({ includeInterceptionIdHeader: false });
+    }
     if (hasStateFingerprint) {
       compatibilityInputs.push({ includeStateFingerprintHeader: false });
-      compatibilityInputs.push({
-        includeInterceptionIdHeader: false,
-        includeStateFingerprintHeader: false,
-      });
+      if (!hasInterceptionId) {
+        compatibilityInputs.push({
+          includeInterceptionIdHeader: false,
+          includeStateFingerprintHeader: false,
+        });
+      }
     }
     if (hasNormalRenderMode) {
       compatibilityInputs.push({ includeRenderModeHeader: false });
-      compatibilityInputs.push({
-        includeInterceptionIdHeader: false,
-        includeRenderModeHeader: false,
-      });
+      if (!hasInterceptionId) {
+        compatibilityInputs.push({
+          includeInterceptionIdHeader: false,
+          includeRenderModeHeader: false,
+        });
+      }
     }
     if (hasStateFingerprint && hasNormalRenderMode) {
       compatibilityInputs.push({
         includeRenderModeHeader: false,
         includeStateFingerprintHeader: false,
       });
-      compatibilityInputs.push({
-        includeInterceptionIdHeader: false,
-        includeRenderModeHeader: false,
-        includeStateFingerprintHeader: false,
-      });
+      if (!hasInterceptionId) {
+        compatibilityInputs.push({
+          includeInterceptionIdHeader: false,
+          includeRenderModeHeader: false,
+          includeStateFingerprintHeader: false,
+        });
+      }
     }
     for (const compatibilityOptions of compatibilityInputs) {
       const input = createCacheBustingInput(options.request.headers, compatibilityOptions);