Redirect www to the canonical host, never serve it

Serving the board on both www and the apex means two origins for one board, and
that is not merely untidy: a session cookie set on one is not sent to the other,
so a magic link opened on www signs you in to a host you then leave — and a
passkey registered on the apex cannot be asserted on www at all. Redirecting
before anything else runs means no credential is ever minted against a hostname
the board does not consider its own.

308 rather than 301 or 302 because only 308 requires the method and body to be
preserved. A form POST to www has to arrive at the apex as the same POST, not as
a GET that silently drops what somebody had just written.

88 tests, 0 type errors.

Author: ralyodio

apps/server/src/app.ts

@@ -47,6 +47,38 @@ export function createApp(registry: Registry, baseUrl: string): Hono<AppEnv> {
     });
   });
 
+  /*
+   * One canonical host.
+   *
+   * www is redirected, never served. Serving both means two origins for the
+   * same board, and that is not merely untidy: a session cookie set on one is
+   * not sent to the other, so a magic link opened on www signs you in to a host
+   * you then leave — and a passkey registered on the apex cannot be asserted on
+   * www at all. Redirecting first means no credential is ever minted against a
+   * hostname the board does not consider its own.
+   *
+   * 308 rather than 301/302 because a 308 requires the method and body to be
+   * preserved: a form POST to www must arrive at the apex as the same POST, not
+   * silently downgraded to a GET that loses what somebody just wrote.
+   */
+  const canonicalHost = (() => {
+    try {
+      return new URL(baseUrl).host;
+    } catch {
+      return null;
+    }
+  })();
+
+  app.use('*', async (c, next) => {
+    const url = new URL(c.req.url);
+    if (canonicalHost && url.host !== canonicalHost && url.host === `www.${canonicalHost}`) {
+      url.host = canonicalHost;
+      url.protocol = new URL(baseUrl).protocol;
+      return c.redirect(url.toString(), 308);
+    }
+    await next();
+  });
+
   app.use('*', async (c, next) => {
     // A bearer token identifies API clients (the TUI); a cookie identifies
     // browsers. A token never confers admin, whatever it was minted with.

test/e2e.test.ts

@@ -373,6 +373,27 @@ describe('a board end to end', () => {
     }
   });
 
+  it('redirects www to the canonical host with a 308, method intact', async () => {
+    // Serving both hosts would mean two origins for one board: a cookie set on
+    // one is not sent to the other, and a passkey registered on the apex cannot
+    // be asserted on www. Redirecting first means no credential is ever minted
+    // against a hostname the board does not consider its own.
+    //
+    // 308 and not 302, because only 308 requires the method and body to be
+    // preserved — a form POST to www must arrive as the same POST, not as a GET
+    // that silently drops what somebody just wrote.
+    for (const method of ['GET', 'POST'] as const) {
+      const response = await app.fetch(
+        new Request('http://localhost:3999/login'.replace('localhost:3999', 'www.localhost:3999'), {
+          method,
+          redirect: 'manual',
+        }),
+      );
+      assert.equal(response.status, 308, method);
+      assert.equal(response.headers.get('location'), 'http://localhost:3999/login');
+    }
+  });
+
   it('reports plugin health', async () => {
     const response = await get('/healthz', false);
     const health = (await response.json()) as { ok: boolean; plugins: string[] };