Skip to content

Fix HTTPFacilitatorClient not following 308 redirects#1813

Merged
phdargen merged 3 commits intocoinbase:mainfrom
ayushozha:fix/http-facilitator-client-follow-redirects
Mar 30, 2026
Merged

Fix HTTPFacilitatorClient not following 308 redirects#1813
phdargen merged 3 commits intocoinbase:mainfrom
ayushozha:fix/http-facilitator-client-follow-redirects

Conversation

@ayushozha
Copy link
Copy Markdown
Contributor

Summary

Fixes #1692

The x402.org/facilitator/supported endpoint returns HTTP 308 before resolving to 200. HTTPFacilitatorClient did not normalize the base URL or explicitly request redirect following, causing syncFacilitatorOnStart to silently fail in some JS runtimes. When no supported payment kinds are loaded, the middleware passes all requests through as 200 instead of returning 402.

Root cause

$ curl -s "https://x402.org/facilitator/supported" -w "\n%{http_code}" -o /dev/null
308

$ curl -sL "https://x402.org/facilitator/supported" -w "\n%{http_code}" -o /dev/null
200

While the Fetch API default redirect mode is "follow", not all JS runtimes (Node.js versions, edge runtimes, polyfills) handle 308 redirects consistently — especially for POST requests where method preservation is required by spec but not always implemented.

Changes

File Change
typescript/packages/core/src/http/httpFacilitatorClient.ts Strip trailing slashes from URL in constructor; add redirect: "follow" to all fetch calls
typescript/packages/core/test/unit/http/httpFacilitatorClient.test.ts Add URL normalization tests + redirect option propagation tests
typescript/.changeset/fix-facilitator-redirect.md Changeset fragment

Test plan

  • URL normalization: trailing slash stripped, multiple slashes stripped, clean URL unchanged, default URL correct
  • Redirect option: redirect: "follow" passed on getSupported(), verify(), settle()
  • Endpoint URL construction correct after normalization
  • All 15 tests pass (7 existing + 8 new)

cc @CarsonRoscoe @andichen0420

@cb-heimdall
Copy link
Copy Markdown

cb-heimdall commented Mar 25, 2026

✅ Heimdall Review Status

Requirement Status More Info
Reviews 1/1
Denominator calculation
Show calculation
1 if user is bot 0
1 if user is external 0
2 if repo is sensitive 0
From .codeflow.yml 1
Additional review requirements
Show calculation
Max 0
0
From CODEOWNERS 0
Global minimum 0
Max 1
1
1 if commit is unverified 0
Sum 1

@vercel
Copy link
Copy Markdown

vercel bot commented Mar 25, 2026

@ayushozha is attempting to deploy a commit to the Coinbase Team on Vercel.

A member of the Team first needs to authorize it.

@github-actions github-actions bot added typescript sdk Changes to core v2 packages labels Mar 30, 2026
@phdargen phdargen self-assigned this Mar 30, 2026
@phdargen
Copy link
Copy Markdown
Contributor

Thanks for the fix @ayushozha, looks good! Please verify your commit and fix the formatting/lint issue

ayushozha and others added 2 commits March 30, 2026 00:56
The x402.org/facilitator/supported endpoint returns HTTP 308 before
resolving to 200. HTTPFacilitatorClient did not normalize the base URL
or explicitly request redirect following, causing syncFacilitatorOnStart
to silently fail in some runtimes. When no supported payment kinds are
loaded, the middleware passes all requests through as 200 instead of 402.

- Strip trailing slashes from facilitator URL in constructor to prevent
  unnecessary 308 redirects from trailing-slash normalization
- Explicitly set redirect: "follow" on all fetch calls (verify, settle,
  getSupported) for cross-runtime compatibility
- Add tests for URL normalization and redirect option propagation

Closes coinbase#1692
@ayushozha ayushozha force-pushed the fix/http-facilitator-client-follow-redirects branch from 3bce7fb to 6064faf Compare March 30, 2026 07:56
@phdargen phdargen merged commit c0e3969 into coinbase:main Mar 30, 2026
16 of 17 checks passed
@ayushozha
Copy link
Copy Markdown
Contributor Author

Thanks @phdargen! If there are any major tasks or issues you'd like to assign me, I'm totally open to contributing more.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

sdk Changes to core v2 packages typescript

Development

Successfully merging this pull request may close these issues.

@x402/express v2.6.0 middleware silently passes through requests (returns 200 instead of 402) with x402.org facilitator

3 participants