Vercel Skew Protection __vdpl cookie missing Path attribute on React Router

(edited)

Hello everyone, last week I submitted a little fix for skew protection on React Router and I didn’t see any update since then

I just realised I should have discussed this here first and so here I am : )

Please let me know how to proceed

https://github.com/vercel/vercel/pull/15372

GitHub

fix: Add Path=/ to __vdpl Skew Protection cookie by MicheleBertoli · Pull Request #15372 · vercel/vercel

The __vdpl cookie is set without a Path attribute in both entry.server.js and edge/entry.server.js: responseHeaders.append('Set-Cookie', `__vdpl=${vercelDeploymentId}; HttpOnly`); Per RFC 6...

Vercel Alum

Thank you for your contribution, Michele! Welcome to the Vercel Community

I've passed this onto the CICD team to review!

Gentle nudge on this one

It's a 2-line change that brings @vercel/react-router in line with how Next.js, SvelteKit, and Qwik already set __vdpl and it unblocks Skew Protection for deep URLs

Happy to add a changeset or any tweaks that'd help, just let me know