[Website] Validate plugin proxy redirect destinations

[brandonpayton]

Motivation for the change, related issues

The proxy's url mode accepts a URL and limits requests to a short list of host names. A redirect points to another URL, so checking only the first URL does not apply that rule to the rest of the redirect chain.

Redirects still need to work because downloads commonly use them. For url mode, the proxy should check each destination before contacting it and stop if any destination is outside the allowed-host list.

The proxy also supplies default response headers for several download routes. If an upstream header is filtered out, it has not been sent and should not prevent a configured default header from being used. In addition, parsed header names are lowercase, so response-header allowlists must use lowercase names too.

Implementation details

streamHttpResponse() now handles all redirects in one bounded PHP loop. cURL makes one request at a time and reports the next redirect URL. When a caller supplies an allowed-host list, PHP checks the hostname before making each request.

Internal download routes use the same redirect loop without the four-host list because their starting URLs are selected by application code and use different download hosts.

The loop follows cURL's redirect behavior:

• It follows up to 30 redirects.
• A POST becomes a GET after a 301 or 302 response.
• A 303 response changes every method except HEAD to GET.
• A 307 or 308 response keeps the original method and body.
• Other methods, including PUT, PATCH, and DELETE, are forwarded correctly.

PHP briefly buffers each response's headers so it can tell whether the response is an intermediate redirect. Intermediate redirect bodies are discarded. The final response body continues streaming to the caller and is never buffered in full.

Response headers are now recorded as present only after they pass the response-header allowlist and are forwarded. This means a filtered upstream header no longer suppresses a configured default header. The Cache-Control entries in the response-header allowlists are also stored as lowercase cache-control, matching the parsed header names.

Testing Instructions (or ideally a Blueprint)

Run the focused endpoint tests:

npm exec nx -- run playground-website:e2e:playwright -- --project=chromium plugin-proxy.spec.ts

Run PHP syntax and website lint checks:

php -l packages/playground/website/public/plugin-proxy.php
php -l packages/playground/website/playwright/e2e/plugin-proxy-test-router.php
npm exec nx -- lint playground-website --skipNxCache

The Playwright suite starts the real PHP endpoint and an in-process Node HTTP proxy. The Node server creates controlled redirect chains and records every requested destination, so the tests can prove that rejected destinations are not contacted. A small PHP test router verifies the headers emitted by PHP's header() function. The tests do not make external requests.

The seven focused tests cover:

1. Rejecting a direct URL outside the allowed-host list.
2. Using a default response header only when the matching upstream header is filtered.
3. Following absolute and relative redirects within the allowed-host list.
4. Rejecting a redirect before contacting a destination outside the list.
5. Preserving POST behavior across 302 and 307 responses.
6. Preserving PUT, PATCH, and DELETE behavior across 302, 303, and 307 responses.
7. Stopping after the 30-redirect limit.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates the website’s plugin proxy “url” mode to validate every redirect destination against an allowlist, preventing off-list redirects from being contacted while still supporting common redirect-based downloads.

Changes:

• Added manual redirect-following loop with per-hop allowlist validation and a dedicated UrlNotAllowedException.
• Refactored streaming to buffer headers until it’s known whether a response is an intermediate redirect.
• Added Playwright E2E coverage that spins up a real PHP endpoint plus an in-process HTTP server to assert redirect behavior and “not contacted” guarantees.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.

File	Description
packages/playground/website/public/plugin-proxy.php	Implements per-redirect allowlist validation and header buffering to avoid leaking intermediate redirect responses while streaming.
packages/playground/website/playwright/e2e/plugin-proxy.spec.ts	Adds an integration-style Playwright test harness that validates redirect chains and ensures blocked destinations are never requested.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[brandonpayton]

This reads well and should be good to go. I plan to give it a final glance and a small test in the morning before merging.