feat: autogenerate default allowedHosts and trustProxyHeaders

README.md

@@ -118,7 +118,7 @@ If you are using Angular 20 or Angular 19 with App Engine Developer Preview:
 
 ```ts
 import { AngularAppEngine, createRequestHandler } from '@angular/ssr'
-import { getContext } from '@netlify/angular-runtime/context.js'
+import { getContext } from '@netlify/angular-runtime/app-engine.js'
 
 const angularAppEngine = new AngularAppEngine()
 
@@ -127,7 +127,7 @@ export async function netlifyAppEngineHandler(request: Request): Promise<Respons
 
   // Example API endpoints can be defined here.
   // Uncomment and define endpoints as necessary.
-  // const pathname = new URL(request.url).pathname;
+  // const pathname = new URL(request.url.pathname)
   // if (pathname === '/api/hello') {
   //   return Response.json({ message: 'Hello from the API' });
   // }
@@ -153,7 +153,7 @@ const commonEngine = new CommonEngine()
 export async function netlifyCommonEngineHandler(request: Request, context: any): Promise<Response> {
   // Example API endpoints can be defined here.
   // Uncomment and define endpoints as necessary.
-  // const pathname = new URL(request.url).pathname;
+  // const pathname = new URL(request.url).pathname
   // if (pathname === '/api/hello') {
   //   return Response.json({ message: 'Hello from the API' });
   // }
@@ -181,9 +181,7 @@ The [`server.ts` file](https://angular.dev/guide/ssr#configure-server-side-rende
 
 ### Requirements
 
-To use the Angular Runtime while building and deploying with the CLI, you need to have `netlify-cli v26.0.0` installed (or a later version).
-
-Please also make sure to use `ntl deploy --build` (rather than `ntl build && ntl deploy`).
+To use the Angular Runtime while building and deploying with the CLI, you need to have `netlify-cli v26.0.0` installed (or a later version). To deploy the site via CLI, please use `netlify deploy`. Using `netlify deploy` with the `--no-build` flag is not supported.
 
 ## Getting Help
 

context.d.ts → app-engine.d.ts

@@ -1,4 +1,4 @@
 // This is duplicating module resolution from package.json#exports
 // because some module resolution settings in tsconfig.json are not honoring export maps
 // https://www.typescriptlang.org/docs/handbook/modules/theory.html#module-resolution
-export * from './src/context.js'
+export * from './src/app-engine.js'

context.js → app-engine.js

@@ -1,4 +1,4 @@
 // This is duplicating module resolution from package.json#exports
 // because some module resolution settings in tsconfig.json are not honoring export maps
 // https://www.typescriptlang.org/docs/handbook/modules/theory.html#module-resolution
-export * from './src/context.js'
+export * from './src/app-engine.js'

demo/package.json

@@ -11,16 +11,16 @@
   },
   "private": true,
   "dependencies": {
-    "@angular/animations": "21.0.0",
-    "@angular/common": "21.0.0",
-    "@angular/compiler": "21.0.0",
-    "@angular/core": "21.0.0",
-    "@angular/forms": "21.0.0",
-    "@angular/platform-browser": "21.0.0",
-    "@angular/platform-browser-dynamic": "21.0.0",
-    "@angular/platform-server": "21.0.0",
-    "@angular/router": "21.0.0",
-    "@angular/ssr": "21.0.0",
+    "@angular/animations": "^21.2.11",
+    "@angular/common": "^21.2.11",
+    "@angular/compiler": "^21.2.11",
+    "@angular/core": "^21.2.11",
+    "@angular/forms": "^21.2.11",
+    "@angular/platform-browser": "^21.2.11",
+    "@angular/platform-browser-dynamic": "^21.2.11",
+    "@angular/platform-server": "^21.2.11",
+    "@angular/router": "^21.2.11",
+    "@angular/ssr": "^21.2.11",
     "@netlify/angular-runtime": "file:..",
     "@netlify/edge-functions": "^3.0.6",
     "express": "^4.21.0",
@@ -29,9 +29,9 @@
     "zone.js": "~0.15.0"
   },
   "devDependencies": {
-    "@angular/build": "21.0.0",
-    "@angular/cli": "21.0.0",
-    "@angular/compiler-cli": "21.0.0",
+    "@angular/build": "^21.2.11",
+    "@angular/cli": "^21.2.11",
+    "@angular/compiler-cli": "^21.2.11",
     "@types/express": "^4.17.21",
     "@types/jasmine": "~5.1.0",
     "@types/node": "^22.0.0",

demo/server.ts

@@ -1,9 +1,12 @@
 import { AngularAppEngine, createRequestHandler } from '@angular/ssr'
-import { getContext } from '@netlify/angular-runtime/context.js'
+import { getAllowedHosts, getContext, getTrustProxyHeaders } from '@netlify/angular-runtime/app-engine.js'
 
-const angularAppEngine = new AngularAppEngine()
+const angularAppEngine = new AngularAppEngine({
+  allowedHosts: getAllowedHosts(),
+  trustProxyHeaders: getTrustProxyHeaders(),
+})
 
-export const netlifyAppEngineHandler = async (request: Request): Promise<Response> => {
+export async function netlifyAppEngineHandler(request: Request): Promise<Response> {
   const context = getContext()
 
   const result = await angularAppEngine.handle(request, context)

package.json

@@ -7,8 +7,8 @@
     "src/**/*.js",
     "src/**/*.json",
     "src/**/*.d.ts",
-    "context.js",
-    "context.d.ts",
+    "app-engine.js",
+    "app-engine.d.ts",
     "common-engine.js",
     "common-engine.d.ts",
     "manifest.yml"
@@ -20,21 +20,21 @@
     ".": {
       "default": "./src/index.js"
     },
+    "./app-engine": {
+      "types": "./src/app-engine.d.ts",
+      "default": "./src/app-engine.js"
+    },
+    "./app-engine.js": {
+      "types": "./src/app-engine.d.ts",
+      "default": "./src/app-engine.js"
+    },
     "./common-engine": {
       "types": "./src/common-engine.d.ts",
       "default": "./src/common-engine.js"
     },
     "./common-engine.js": {
       "types": "./src/common-engine.d.ts",
       "default": "./src/common-engine.js"
-    },
-    "./context": {
-      "types": "./src/context.d.ts",
-      "default": "./src/context.js"
-    },
-    "./context.js": {
-      "types": "./src/context.d.ts",
-      "default": "./src/context.js"
     }
   },
   "scripts": {
@@ -85,13 +85,14 @@
     "node": "^22.22.0 || ^24.13.1 || >=26.0.0"
   },
   "devDependencies": {
-    "@opentelemetry/api": "~1.8.0",
+    "@netlify/build": "^35.13.6",
+    "@netlify/edge-functions": "^3.0.6",
     "@netlify/eslint-config-node": "^7.0.1",
+    "@opentelemetry/api": "~1.8.0",
     "@types/node": "^24.0.0",
     "eslint-plugin-unicorn": "^49.0.0",
     "husky": "^9.1.7",
     "netlify-cli": "^26.0.2",
-    "@netlify/build": "^35.13.6",
     "npm-run-all2": "^8.0.4",
     "prettier": "^3.8.3"
   },

src/app-engine.d.ts

@@ -0,0 +1,5 @@
+import type { Context } from '@netlify/edge-functions'
+
+export declare function getAllowedHosts(): string[]
+export declare function getContext(): Context | undefined
+export declare function getTrustProxyHeaders(): string[]

src/app-engine.js

@@ -0,0 +1,54 @@
+import { env } from 'node:process'
+
+export function getAllowedHosts() {
+  const allowedHosts = []
+  const environmentVariables = ['DEPLOY_ID', 'DEPLOY_PRIME_URL', 'DEPLOY_URL', 'SITE_ID', 'SITE_NAME', 'URL']
+
+  for (const environmentVariable of environmentVariables) {
+    if (!env[environmentVariable] || env[environmentVariable] === 'undefined') {
+      console.warn(
+        `Missing Netlify-specific environment variable ${environmentVariable}. \`allowedHosts\` config might be incomplete.`,
+      )
+      return allowedHosts
+    }
+  }
+
+  const deployPrimeUrlHostname = new URL(env.DEPLOY_PRIME_URL).hostname
+
+  // <subdomain>.netlify.app OR <custom-domain>
+  // www handling is not required as Netlify will auto-redirect
+  allowedHosts.push(new URL(env.URL).hostname)
+  // <deploy-id>--<subdomain>.netlify.app
+  allowedHosts.push(new URL(env.DEPLOY_URL).hostname)
+  // <branch-name>--<subdomain>.netlify.app or <dp-#>--<subdomain>.netlify.app (supports ADS)
+  allowedHosts.push(deployPrimeUrlHostname)
+  // <subdomain>.netlify.app
+  // this will be duplicated for sites without custom domain
+  // but it's important to have in case a site's custom domain is removed after a deploy
+  allowedHosts.push(`${env.SITE_NAME}.netlify.app`)
+  // <site-id>.netlify.app
+  allowedHosts.push(`${env.SITE_ID}.netlify.app`)
+  // <deploy-id>--<site-id>.netlify.app
+  allowedHosts.push(`${env.DEPLOY_ID}--${env.SITE_ID}.netlify.app`)
+
+  // we need to extract the branch name or the deploy preview number
+  // so we can add the subdomain as well as site-id specific URLs
+  // this would be required for sites using ADS so that
+  // we can add netlify.app URLs as well
+  if (deployPrimeUrlHostname.includes('--')) {
+    const [branchNameOrDpNumber] = deployPrimeUrlHostname.split('--')
+    allowedHosts.push(`${branchNameOrDpNumber}--${env.SITE_NAME}.netlify.app`)
+    allowedHosts.push(`${branchNameOrDpNumber}--${env.SITE_ID}.netlify.app`)
+  }
+
+  return allowedHosts
+}
+
+export function getContext() {
+  // eslint-disable-next-line no-undef
+  return typeof Netlify !== 'undefined' ? Netlify?.context : undefined
+}
+
+export function getTrustProxyHeaders() {
+  return ['x-forwarded-for']
+}