Skip to content

fix: preserve stripped path prefixes in trailing-slash redirects#16431

Merged
Rich-Harris merged 5 commits into
sveltejs:version-3from
Nic-Polumeyv:fix-relative-trailing-slash-redirects
Jul 20, 2026
Merged

fix: preserve stripped path prefixes in trailing-slash redirects#16431
Rich-Harris merged 5 commits into
sveltejs:version-3from
Nic-Polumeyv:fix-relative-trailing-slash-redirects

Conversation

@Nic-Polumeyv

@Nic-Polumeyv Nic-Polumeyv commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

Fixes #13718. Supersedes #13719, credit to @HoldYourWaffle for the diagnosis and approach.

The trailing slash redirects use absolute pathnames, so any prefix a parent server strips before the request reaches kit (an Express mount, #13702) is dropped and the browser lands outside the app. The prefix never reaches Polka's parser, so it can't be reconstructed server side. A relative Location resolves against the full browser URL and is prefix-agnostic.

Per the review on #13719, the helper is implemented in kit rather than adding get-relative-path, stays internal instead of being exported from @sveltejs/kit/node, and adapter-node gets a local copy since its handler is bundled standalone. Both call sites only produce pathnames differing by a trailing slash, so it handles exactly that case. The #2515 guard becomes unnecessary, a relative reference never starts with /.

The options app trailingSlash tests now assert the Location values and fail on the old code. The prerender crawler resolves locations with new URL(), so it follows the relative form unchanged. Verified end to end with an adapter-node build mounted under a stripped prefix, both the SSR and the prerendered redirect.

No adapter-node test app here since #16305 is establishing that infrastructure.

Please don't delete this checklist! Before submitting the PR, please make sure you do the following:

  • It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs
  • This message body should clearly illustrate what problems it solves.
  • Ideally, include a test that fails without this PR but passes with it.

Tests

  • Run the tests with pnpm test and lint the project with pnpm lint and pnpm check

Changesets

  • If your PR makes a change that should be noted in one or more packages' changelogs, generate a changeset by running pnpm changeset and following the prompts. Changesets that add features should be minor and those that fix bugs should be patch. Please prefix changeset messages with feat:, fix:, or chore:.

Edits

  • Please ensure that 'Allow edits from maintainers' is checked. PRs without this option may be closed.

@pkg-svelte-dev

pkg-svelte-dev Bot commented Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown

Install the latest version of @sveltejs/kit from f96bef2:

pnpm add https://pkg.svelte.dev/@sveltejs/kit/c/f96bef2cccbea3db324016b826aada124da94224

Open in pkg.svelte.dev: https://pkg.svelte.dev/repos/kit/pr/16431

Note

This PR is from a fork. A maintainer must approve approve each commit before it can be built and installed.

Rich-Harris
Rich-Harris approved these changes Jul 20, 2026
View reviewed changes

@Rich-Harris Rich-Harris left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is great, thank you

@Rich-Harris
Rich-Harris merged commit 17a45ca into sveltejs:version-3 Jul 20, 2026
16 of 17 checks passed
@github-actions github-actions Bot mentioned this pull request Jul 20, 2026
Merged
@teemingc teemingc mentioned this pull request Jul 21, 2026
Closed
10 tasks
teemingc
teemingc reviewed Jul 21, 2026
View reviewed changes
Comment thread packages/kit/src/utils/url.spec.js

describe('relative_pathname', (test) => {
test('converts trailing-slash redirects to relative URL references', () => {
const cases = [

@teemingc teemingc Jul 21, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In the future, we can use test.each for better support by Vitest https://vitest.dev/api/test.html#test-each

Rich-Harris pushed a commit that referenced this pull request Jul 24, 2026
@github-actions
Version Packages (next) (#16435)
c6bfbbd 
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to version-3, this PR
will be updated.

⚠️⚠️⚠️⚠️⚠️⚠️

`version-3` is currently in **pre mode** so this branch has prereleases
rather than normal releases. If you want to exit prereleases, run
`changeset pre exit` on `version-3`.

⚠️⚠️⚠️⚠️⚠️⚠️

# Releases
## @sveltejs/kit@3.0.0-next.12

### Major Changes

- breaking: rename `Pathname` type to `Path` and `Asset` to `AssetPath`
([#16430](#16430))
  breaking: remove leading `/` from `Path` and `AssetPath`
- breaking: write tsconfig to `node_modules/$app/tsconfig`
([#16458](#16458))

- breaking: error on `event.url`, `event.params` and `event.route`
access inside queries
([#16452](#16452))

- breaking: delete `$service-worker` module
([#16450](#16450))

- breaking: detect new deployments on data, remote, and form action
responses, tab focus, and visibility change, and default
`version.pollInterval` to 1 hour
([#16496](#16496))

### Minor Changes

- feat: add `$app/manifest` module with `immutable`, `assets`,
`prerendered`, and `routes` exports
([#16372](#16372))

- feat: validate that all remote form fields were created with
form.fields.foo.as(...)
([#16331](#16331))

- feat: make `$app/paths` importable in service workers
([#16441](#16441))

- feat: `$app/service-worker` module
([#16458](#16458))

- feat: better tsconfig validation
([#16458](#16458))

- fix: default cookies to `secure` to `false` during development
([#16462](#16462))

### Patch Changes

- fix: allow `undefined` values to be passed to form field `.as(...)`
where applicable ([#15681](#15681))

- fix: include queries refreshed from within another query in the
serialized response
([#16461](#16461))

- fix: generate sourcemaps for remote modules
([#16440](#16440))

- fix: avoid empty getElementById() call on hash routing navigation
([#16448](#16448))

- fix: warn if hook files are spelled as "hook" instead of "hooks"
([#16483](#16483))

- chore: deprecate the `alias` option
([#16470](#16470))

- fix: prevent infinite loops when server-side queries refresh each
other in a cycle during the single-flight drain
([#16461](#16461))

- fix: populate `version` in service workers
([#16434](#16434))

- fix: resolve remote modules as external during dev prebundling so
packages can re-export remote functions
([#16426](#16426))

- fix: refetch route-tracking server data when navigating away from an
error page ([#16381](#16381))

- fix: serialize `query(...).set(...)`/`query(...).refresh()` values
into the rendered HTML when called from within a query during SSR
([#16461](#16461))

- fix: fall back to the page's form actions when a sibling endpoint has
no POST handler ([#16349](#16349))

- fix: return a lightweight 404 instead of rendering the error page for
subresource requests
([#16463](#16463))

- fix: preserve stripped path prefixes by making trailing-slash
redirects relative
([#16431](#16431))

- chore: deduplicate type-stripping logic in `tweak_types`
([#16454](#16454))

- fix: more informative error message when running a command inside a
query or prerender function
([`eb5c973`](eb5c973))
## @sveltejs/adapter-cloudflare@8.0.0-next.3

### Patch Changes

- chore: bump `@cloudflare/workers-types` to `4.20260621.1`
([#16455](#16455))
- Updated dependencies
[[`adc4c5b`](adc4c5b),
[`ecb0701`](ecb0701),
[`4b4cc60`](4b4cc60),
[`7390dbe`](7390dbe),
[`2e71340`](2e71340),
[`c87bc3a`](c87bc3a),
[`af15c6c`](af15c6c),
[`c6fa431`](c6fa431),
[`bfe4dea`](bfe4dea),
[`df7dc72`](df7dc72),
[`5ae11a1`](5ae11a1),
[`781205c`](781205c),
[`c87bc3a`](c87bc3a),
[`a1bfeb9`](a1bfeb9),
[`c87bc3a`](c87bc3a),
[`9f0127d`](9f0127d),
[`4b4cc60`](4b4cc60),
[`8f5b9c7`](8f5b9c7),
[`c9b5544`](c9b5544),
[`fe1d4a4`](fe1d4a4),
[`4b4cc60`](4b4cc60),
[`5f78e95`](5f78e95),
[`25510fc`](25510fc),
[`c99a6cf`](c99a6cf),
[`17a45ca`](17a45ca),
[`2ca20c3`](2ca20c3),
[`eb5c973`](eb5c973)]:
  - @sveltejs/kit@3.0.0-next.12
## @sveltejs/adapter-netlify@7.0.0-next.4

### Patch Changes

- fix: await `init` on every request to prevent race condition
([#16467](#16467))

- chore: bump Rolldown to `1.2.0`
([#16455](#16455))
- Updated dependencies
[[`adc4c5b`](adc4c5b),
[`ecb0701`](ecb0701),
[`4b4cc60`](4b4cc60),
[`7390dbe`](7390dbe),
[`2e71340`](2e71340),
[`c87bc3a`](c87bc3a),
[`af15c6c`](af15c6c),
[`c6fa431`](c6fa431),
[`bfe4dea`](bfe4dea),
[`df7dc72`](df7dc72),
[`5ae11a1`](5ae11a1),
[`781205c`](781205c),
[`c87bc3a`](c87bc3a),
[`a1bfeb9`](a1bfeb9),
[`c87bc3a`](c87bc3a),
[`9f0127d`](9f0127d),
[`4b4cc60`](4b4cc60),
[`8f5b9c7`](8f5b9c7),
[`c9b5544`](c9b5544),
[`fe1d4a4`](fe1d4a4),
[`4b4cc60`](4b4cc60),
[`5f78e95`](5f78e95),
[`25510fc`](25510fc),
[`c99a6cf`](c99a6cf),
[`17a45ca`](17a45ca),
[`2ca20c3`](2ca20c3),
[`eb5c973`](eb5c973)]:
  - @sveltejs/kit@3.0.0-next.12
## @sveltejs/adapter-node@6.0.0-next.6

### Patch Changes

- fix: preserve stripped path prefixes by making trailing-slash
redirects relative
([#16431](#16431))

- chore: bump Rolldown to `1.2.0`
([#16455](#16455))
- Updated dependencies
[[`adc4c5b`](adc4c5b),
[`ecb0701`](ecb0701),
[`4b4cc60`](4b4cc60),
[`7390dbe`](7390dbe),
[`2e71340`](2e71340),
[`c87bc3a`](c87bc3a),
[`af15c6c`](af15c6c),
[`c6fa431`](c6fa431),
[`bfe4dea`](bfe4dea),
[`df7dc72`](df7dc72),
[`5ae11a1`](5ae11a1),
[`781205c`](781205c),
[`c87bc3a`](c87bc3a),
[`a1bfeb9`](a1bfeb9),
[`c87bc3a`](c87bc3a),
[`9f0127d`](9f0127d),
[`4b4cc60`](4b4cc60),
[`8f5b9c7`](8f5b9c7),
[`c9b5544`](c9b5544),
[`fe1d4a4`](fe1d4a4),
[`4b4cc60`](4b4cc60),
[`5f78e95`](5f78e95),
[`25510fc`](25510fc),
[`c99a6cf`](c99a6cf),
[`17a45ca`](17a45ca),
[`2ca20c3`](2ca20c3),
[`eb5c973`](eb5c973)]:
  - @sveltejs/kit@3.0.0-next.12
## @sveltejs/adapter-vercel@7.0.0-next.3

### Patch Changes

- fix: await `init` on every request to prevent race condition
([#16467](#16467))

- chore: bump Rolldown to `1.2.0`
([#16455](#16455))
- Updated dependencies
[[`adc4c5b`](adc4c5b),
[`ecb0701`](ecb0701),
[`4b4cc60`](4b4cc60),
[`7390dbe`](7390dbe),
[`2e71340`](2e71340),
[`c87bc3a`](c87bc3a),
[`af15c6c`](af15c6c),
[`c6fa431`](c6fa431),
[`bfe4dea`](bfe4dea),
[`df7dc72`](df7dc72),
[`5ae11a1`](5ae11a1),
[`781205c`](781205c),
[`c87bc3a`](c87bc3a),
[`a1bfeb9`](a1bfeb9),
[`c87bc3a`](c87bc3a),
[`9f0127d`](9f0127d),
[`4b4cc60`](4b4cc60),
[`8f5b9c7`](8f5b9c7),
[`c9b5544`](c9b5544),
[`fe1d4a4`](fe1d4a4),
[`4b4cc60`](4b4cc60),
[`5f78e95`](5f78e95),
[`25510fc`](25510fc),
[`c99a6cf`](c99a6cf),
[`17a45ca`](17a45ca),
[`2ca20c3`](2ca20c3),
[`eb5c973`](eb5c973)]:
  - @sveltejs/kit@3.0.0-next.12

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@teemingc teemingc teemingc left review comments
@Rich-Harris Rich-Harris Rich-Harris approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Trailing slash normalization always redirects against root

3 participants

@Nic-Polumeyv @Rich-Harris @teemingc