Skip to content

Keep the storefront exit page working in the theme dev server - #9012

Merged
jplhomer merged 3 commits into
mainfrom
jplhomer/theme-dev-server-url-navigate
Nov 3, 2026
Merged

jplhomer merged 3 commits into
mainfrom
jplhomer/theme-dev-server-url-navigate

Conversation

@jplhomer

Copy link
Copy Markdown
Contributor

WHY are these changes introduced?

In shopify theme dev and theme app extension previews in shopify app dev, clicking a link to another site always showed the storefront's "leaving this store" confirmation page. That happened even when the live store or the admin theme preview sends the shopper straight there.

The dev server's proxy caused it in two ways:

  1. The storefront's exit page (/url) only continues to another site when the request is a real navigation (Sec-Fetch-Mode: navigate). The browser sends that header to the local server. The CLI then re-sends the request with Node's global fetch, which always replaces Sec-Fetch-Mode with its own request mode (cors). So the storefront showed the confirmation page every time.
  2. Even when the storefront did redirect, the proxy stripped the origin from every Location header. https://example.com/ became /, and the shopper landed back on the local server.

WHAT is this pull request doing?

  • storefront-renderer.ts: a GET to the exit page (/url or /:locale/url) is sent with cli-kit's fetch (node-fetch), which forwards the browser's Sec-Fetch-* headers unchanged.
    • It sends the same headers and cookies as other render requests and keeps redirect: 'manual' and the same error handling.
    • It uses slow-request mode, so there are no retries and no timeout, the same as the global fetch.
    • The response is converted to a web Response, and every Set-Cookie is kept.
    • The exit page doesn't render theme templates, so this request is always a GET, even when there are unsynced local templates.
    • Every other page still renders the same way as before.
  • proxy.ts: a Location header is only turned into a local path when it points to the store (a relative path or the store's domain). Redirects to other hosts stay absolute. For store redirects, the existing _fd/pb cleanup and the checkout exception are unchanged.

How to manually test your changes?

  1. Use a store whose storefront shows a confirmation page before shoppers leave for another site. Run shopify theme dev, or shopify app dev with a theme app extension, using this branch.
  2. In the local preview, click a link to another site (e.g. https://example.com/).
    • Before: the confirmation page shows for every external link. If the storefront does redirect, you end up back on the local server.
    • After: the preview behaves like the admin theme preview. Links the storefront allows go straight to the other site, and the confirmation page only shows when it would show there too.
  3. Links within the store, the store's own redirects (for example /cart or localization redirects) and checkout should work as before.

Checklist

  • I've considered possible cross-platform impacts (Mac, Linux, Windows)
  • I've considered possible documentation changes
  • I've considered analytics changes to measure impact
  • The change is user-facing — I've identified the correct bump type (patch for bug fixes · minor for new features · major for breaking changes) and added a changeset with pnpm changeset add

@github-actions github-actions Bot added the Area: @shopify/cli @shopify/cli package issues label Oct 26, 2026
@jplhomer
jplhomer marked this pull request as ready for review October 26, 2026 15:29
@jplhomer
jplhomer requested a review from a team as a code owner October 26, 2026 15:30
Copilot AI balanced review requested due to automatic review settings October 26, 2026 15:30

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

@jplhomer

jplhomer commented Nov 2, 2026 •

Copy link
Copy Markdown
Contributor Author

@bashu-shopify good catch on Theme Access (also TIL that exists). Let's try to get this fix in, and then open another PR for fixing Theme Access.

I'll try to get this landed for a 5.0 patch; just need someone with magical permissions to review.

@jplhomer
jplhomer requested a review from dmerand November 2, 2026 19:25

@bashu-shopify bashu-shopify left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

hi josh.

I think this rule becomes broader than the exit page behaviour. It runs on every proxied response, so POST /localization gets it too. A market redirect like https://mystore.fr/products/new used to become a local path. Now it goes to the live site.

The storefront does send these. _fd=0 only stops the primary-domain redirect. The overridden market redirect still fires, and market_web_presence_redirect_integration_test.rb asserts it. Core's localization 307 looks like it ignores _fd too, though I haven't run either.

so, request: Could we limit the rule to the exit page? That page only redirects to the destination, and it returns a 404 for destinations on the store's own site. So the store-host branch never applies to it. The rest of the proxy could keep the old behavior, and the // fix would still apply there.

Would that work for you?

Only the storefront exit page keeps redirects to other sites absolute.
Every other proxied response, such as POST /localization, keeps the
previous behavior: a non-checkout Location becomes a local path, so
market domain redirects still stay on the local server.
@jplhomer

jplhomer commented Nov 2, 2026

Copy link
Copy Markdown
Contributor Author

@bashu-shopify good catch! Updated.

@jplhomer
jplhomer added this pull request to the merge queue Nov 3, 2026
Merged via the queue into main with commit 7c300ea Nov 3, 2026
29 checks passed
@jplhomer
jplhomer deleted the jplhomer/theme-dev-server-url-navigate branch November 3, 2026 15:13
jplhomer added a commit that referenced this pull request Nov 3, 2026
…ble-5.0

[5.0] Backport 5.0.1 fixes (#9012, #9014, and ten more)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Area: @shopify/cli @shopify/cli package issues

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants