Skip to content

DISCO-184: spike: explore using http-proxy-middleware - #446

Draft
Philipp Koytek (philippkoytek) wants to merge 11 commits into
mainfrom
feature/DISCO-154-sdk-preview-http-proxy-middleware
Draft

Philipp Koytek (philippkoytek) wants to merge 11 commits into
mainfrom
feature/DISCO-154-sdk-preview-http-proxy-middleware

Conversation

@philippkoytek

@philippkoytek Philipp Koytek (philippkoytek) commented Oct 29, 2026 •

Copy link
Copy Markdown
Contributor

Stacked on #444. Spike for DISCO-184: rebuild the preview proxy on http-proxy-middleware to reduce the code we maintain.

What changed

  • Removed the hand-written request forwarding, raw-socket WebSocket tunnel, keep-alive agent and TLS handling.
  • Kept the HTML buffering for inline-script hashing and CSP rewrite, the 502 message and the port-in-use error.
  • preview-proxy.ts goes from 207 to 170 lines. The existing proxy spec passes unchanged.

For discussion

  • responseInterceptor doesn't fit: it always rewrites content-length and writes an error message on a mid-body failure, which the current tests forbid. The HTML branch stays hand-written.
  • http-proxy doesn't reliably cancel the upstream request when a client disconnects before the target answers, so a small res.on("close") hook remains.
  • New runtime dependency: http-proxy-middleware v3 builds on http-proxy, which gets few updates.
  • Is a ~37-line reduction worth that dependency?

Draft: not intended to merge without a team decision.

Co-Authored-By: Claude noreply@anthropic.com
Includes-AI-Code: true

Co-Authored-By: Claude <noreply@anthropic.com>
Includes-AI-Code: true
Co-Authored-By: Claude <noreply@anthropic.com>
Includes-AI-Code: true
Co-Authored-By: Claude <noreply@anthropic.com>
Includes-AI-Code: true
Co-Authored-By: Claude <noreply@anthropic.com>
Includes-AI-Code: true
Co-Authored-By: Claude <noreply@anthropic.com>
Includes-AI-Code: true
…ine-scripts

The preview now blocks inline scripts by default, like published apps, and warns
about each one with a hint to pass --allow-inline-scripts.

Co-Authored-By: Claude <noreply@anthropic.com>
Includes-AI-Code: true
Co-Authored-By: Claude <noreply@anthropic.com>
Includes-AI-Code: true
Moves the proxy's close() out of the listen callback, uses Sets for the loopback hostnames and bodiless statuses, parses --port without a nested ternary, and asserts that the disconnect test's target request closes.

Co-Authored-By: Claude <noreply@anthropic.com>
Includes-AI-Code: true
Replaces the hand-written request forwarding, raw-socket WebSocket tunnel,
keep-alive agent and TLS handling with http-proxy-middleware. The HTML
buffering for inline-script hashing and CSP rewriting stays as a small
proxyRes handler.

Co-Authored-By: Claude <noreply@anthropic.com>
Includes-AI-Code: true
@sonarqubecloud

Copy link
Copy Markdown

Quality Gate Failed Quality Gate failed

Failed conditions
1 New Major Issues (required ≤ 0)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

Base automatically changed from feature/DISCO-154-sdk-preview to main November 2, 2026 09:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant