handleFetch hook receive empty event object after 2.31.0 sveltekit upgrade #15040

Activity

1. Conduitry commented on Dec 8, 2025

   

   Conduitry

   on Dec 8, 2025

   Member

   More actions

   Please provide a complete and minimal reproduction, not just a code snippet referring to other parts of your codebase that aren't included.
2. Conduitry

   added

   awaiting submitter

   on Dec 8, 2025
3. timephy commented on Dec 17, 2025

   

   timephy

   on Dec 17, 2025

   Last edited by timephy

   More actions

   When updating past 2.31.0 I get this error with vite dev SSR using the provided fetch to request some data.

   CORS error: No 'Access-Control-Allow-Origin' header is present on the requested resource
       at universal_fetch (...)
   

   I run this in hooks.server.ts:

   const handleForwardedProto: Handle = async ({ event, resolve }) => {
       const proto = event.request.headers.get("x-forwarded-proto")
       if (proto) {
           event.url = new URL(event.url.href.replace(/^http:/, `${proto}:`))
       }
       return resolve(event)
   }
   export const handle = handleForwardedProto

   I set this up a long time ago.

   Removing it does not solve the issue.
4. timephy commented on Dec 18, 2025

   

   timephy

   on Dec 18, 2025

   More actions

   CORS error: No 'Access-Control-Allow-Origin' header is present on the requested resource
   at universal_fetch (...)

   I should have mentioned that I have a Traefik Reverse Proxy on a dev.example.com domain, that proxies the request to my local machine running vite dev.
5. golaughlin commented on Dec 25, 2025

   

   golaughlin

   on Dec 25, 2025

   More actions

   I'm also getting a CORS error: No 'Access-Control-Allow-Origin' header is present on the requested resource error when I try to fetch JSON from a REST API.

   ./routes/children/+page.ts

   import type { PageLoad } from "./$types";
   
   interface Child {
       id: number;
       firstName: string;
       lastName: string;
   }
   
   export const load: PageLoad = async ({ fetch }) => {
       const res = await fetch("http://localhost:8000/children");
       const fetchedChildren = await res.json();
   
       return {
           children: fetchedChildren.map((child: Child) => ({
               id: child.id,
               firstName: child.firstName,
               lastName: child.lastName
           }))
       };
   }
   

   ./routes/children/+page.svelte

   <script lang="ts">
       import type { PageProps } from "../$types";
   
       let { data }: PageProps = $props();
   </script>
   
   <h1 class="font-bold text-4xl mb-4">List of Children</h1>
   
   <ul class="">
       {#each data.children as { id, firstName, lastName }}
           <li><a href="/children/{id}">{lastName}, {firstName}</a></li>
       {/each}
   </ul>
   

   VSCode also throws a Property 'children' does not exist on type '{}' problem.
6. timephy commented on Jan 7, 2026

   

   timephy

   on Jan 7, 2026

   Last edited by timephy

   More actions

   As this (in my case) seems to depend on individual-domain-hosting... How can I help recreate this for you? @Conduitry

   I would love to help push this into the right direction to get this fixed. It's preventing me from updating atm..
7. timephy commented on Feb 14, 2026

   

   timephy

   on Feb 14, 2026

   Last edited by timephy

   More actions

   I, again, updated past SvelteKit 2.31.0 and ran into the same issue.

   However I found a fix. But I really don't know if this is the way it is supposed to be...

   // hooks.server.ts
   
   // We have to handle the x-forwarded-proto header, because we are deployed behind a reverse proxy
   // Otherwise CORS errors with sveltekit server to backend will occur, especially with using the `fetch` API in load function
   
   export const handle: Handle = async ({ event, resolve }) => {
       const proto = event.request.headers.get("x-forwarded-proto")
       if (proto) {
           event.url = new URL(event.url.href.replace(/^http:/, `${proto}:`))
       }
       return resolve(event)
   }
   
   export const handleFetch: HandleFetch = async ({ request, event, fetch }) => {
       const url = new URL(request.url)
       const proto = event.request.headers.get("x-forwarded-proto")
   
       // Derive public origin (same logic as handleForwardedProto)
       const publicOrigin = proto ? event.url.origin.replace(/^http:/, `${proto}:`) : event.url.origin
   
       // Inject Origin header for cross-origin requests
       if (url.origin !== publicOrigin && !request.headers.get("origin")) {
           const headers = new Headers(request.headers)
           headers.set("origin", publicOrigin)
           request = new Request(request, { headers })
       }
   
       return fetch(request)
   }

   My network setup is the following:

   Frontend: https://example.com → Traefik Reverse Proxy → SvelteKit/Vite dev server
   Backend: https://api.example.com → Traefik Reverse Proxy → Rust backend server

   ---

   Request for comment

   🙏🏽 I'd highly appreciate at least a comment pointing out a possible mistake or misunderstanding...
8. teemingc commented on Feb 14, 2026

   

   teemingc

   on Feb 14, 2026

   Last edited by teemingc

   Member

   More actions

   The issue with troubleshooting this is that there are too many variables to consider. The very least we would need is to know the exact way you’ve setup your reverse proxy, sveltekit project and the how the request was sent. So we need a reproduction repository and reproduction steps
9. Nic-Polumeyv commented on Jul 26, 2026

   

   Nic-Polumeyv

   on Jul 26, 2026

   Member

   More actions

   https://github.com/Nic-Polumeyv/sveltekit-handlefetch-event-probe runs the same app against 2.30.1, 2.31.0 and 2.70.1. On 2.30.1, a handle hook that reassigns event.url from x-forwarded-proto propagates everywhere. From 2.31.0 on, handleFetch sees the stale url, and a reassigned event.locals arrives empty, which is the empty event reported here.

   The cause is #13899, shipped in 2.31.0. handle receives a spread copy of the event (traced_event = { ...event, tracing } in respond.js), while event.fetch was created earlier and closed over the original. Reassignments inside handle land on the copy. handleFetch, the origin header kit injects into server fetches, and cookie forwarding all read the original; the CORS check in universal load reads the copy. In the proxy setup no backend header can pass: kit sends Origin: http://… and when the backend echoes exactly that in Access-Control-Allow-Origin, the check still fails because it compares against the mutated url. Property writes like event.locals.user = x still propagate because the copy is shallow. @timephy's workaround works because kit only injects origin when the header is absent, so setting it in handleFetch wins.

   @golaughlin's case is different: fetching a cross-origin API that returns no Access-Control-Allow-Origin fails on every version, that check predates this (#7454).

   Rich suggested making tracing getter-based during #13899 review so the same event object could flow throughout (#13899 (comment)), which would fix this class. The alternative is declaring property reassignment in handle unsupported, as #11902 (comment) already does for the underlying x-forwarded-proto pattern, though 2.30.x supported it in practice.
10. Rich-Harris commented on Aug 5, 2026

    

    Rich-Harris

    on Aug 5, 2026

    Member

    More actions

    You can't just reassign event.url. That needs to happen before SvelteKit sees the app. I guess we need to mark that property readonly in the types.

    I'm also getting a CORS error: No 'Access-Control-Allow-Origin' header is present on the requested resource error when I try to fetch JSON from a REST API.

    It sounds like whatever's serving from localhost:8000 isn't adding an Access-Control-Allow-Origin header? Seems unrelated to the issue at hand.

    VSCode also throws a Property 'children' does not exist on type '{}' problem.

    That's because you're importing ../$types instead of ./$types. If you're using VS Code with the Svelte extension you don't need to import any types, they will be injected for you.

    Am inclined to close this issue — the OP is vague and there's no repro, and the other two things don't sound like SvelteKit bugs.
11. Rich-Harris

    closed this as completedin #16661on Aug 5, 2026
12. Rich-Harris

    added a commit that references this issue on Aug 5, 2026

    fix: mark `RequestEvent` properties as `readonly` (#16661)

    ...

    This issue will close once commit 8763327 is merged into the 'main' branch.

    8763327