Astro Info

Astro                    v5.12.6
Node                     v22.20.0
System                   macOS (arm64)
Package Manager          unknown
Output                   server
Adapter                  @astrojs/vercel
Integrations             @astrojs/sitemap

If this issue only occurs in one browser, which browser is a problem?

No response

Describe the Bug

The browser does not set the x-deployment-id header.

I can see from a previous PR that it looks like the header was assigned inside the function invocation. But that won't work given that skew protection is applied before functions are invoked. It needs to come from the client js.

https://vercel.com/docs/skew-protection

What's the expected result?

The browser should include the x-deployment-id in the request headers (or in the cookie or query string).

I actually think the cookie or query string would be the right solution for Astro since it also include a hash when bundling static assets. So those requests won't invoke a function and the only way to protect from skew is cookie or query string.

Link to Minimal Reproducible Example

https://github.com/vercel-support/astro-skew

Participation

• I am willing to submit a pull request for this issue.